CVE-2026-97377: SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Which deployments are affected?
SuiteCRM versions before 7.15.2 and 8.10.2 are affected if the legacy SOAP portal method portal_get_entry_list is available. The issue is fixed in SuiteCRM 7.15.2 and 8.10.2.
What access does an attacker need?
An attacker needs credentials for a low-privileged portal API user. No user interaction is required, and exploitation can be performed remotely through the SOAP portal method.
What could an attacker do through this flaw?
A low-privileged portal API user can conduct blind SQL injection through caller-controlled where and order_by values. This can disclose database metadata and sensitive records, alter query behavior, and consume resources.
How can we determine whether we are exposed?
Check the deployed SuiteCRM version and whether the legacy SOAP portal interface exposes portal_get_entry_list to portal API users. Deployments running a version earlier than 7.15.2 or 8.10.2 with that method available should be treated as affected.