GHSA-gcc4-hvpc-cgvv: SuiteCRM: Authenticated SQL Injection In Project Module

Published Nov 5, 2026

Updated

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. An authenticated attacker can alter query structure and disclose sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SuiteCRM to a version that resolves this vulnerability.
Fixed in 7.15.2
Upgrade
Upgrade SuiteCRM to a version that resolves this vulnerability.
Fixed in 8.10.2

Event History

Nov 5, 2026

CVE Published

via OSV·06:23 PM

Data Sourced

via OSV·06:23 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

SuiteCRM deployments running versions earlier than 7.15.2 or 8.10.2 are affected if users can access the Project module. Exploitation requires an authenticated account.

What can an attacker do with this vulnerability?

An authenticated attacker can manipulate the duplicateId POST parameter to alter a database query and disclose sensitive information from the database. The provided impact information indicates high confidentiality impact and low integrity impact.

Are patched versions available?

Yes. The issue is fixed in SuiteCRM 7.15.2 and 8.10.2.

GHSA-gcc4-hvpc-cgvv: SuiteCRM: Authenticated SQL Injection In Project Module

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What can an attacker do with this vulnerability?

Are patched versions available?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What can an attacker do with this vulnerability?

Are patched versions available?