CVE-2026-69140: SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates getlatestforid directly into an SQL UPDATE statement. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Documents module access can disclose database data and mass-update linkeddocuments records, while stacked statements and arbitrary DROP or INSERT operations are not supported by this vector. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances running SuiteCRM versions earlier than 7.15.2 or 8.10.2 are affected. Exploitation requires a low-privileged authenticated user that has access to the Documents module.
What could an attacker do with this vulnerability?
An attacker can disclose database data and mass-update linked_documents records. The described injection vector does not support stacked statements or arbitrary DROP or INSERT operations.
Is unauthenticated exploitation possible?
No. The available information states that the attacker needs low-privileged access and Documents module permissions.
What versions contain the fix?
Upgrade SuiteCRM to 7.15.2 or 8.10.2, depending on the release branch in use. These versions fix the SQL injection in GetLatestRevision.php.