SQL Injection in Suitecrm
CVE-2026-61651
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the get_end_date action in Projects Controller concatenates an authenticated caller's task_id value into a SQL query without parameterization. A low-privileged user can use blind SQL injection to enumerate the database schema and extract credentials, customer records, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Suitecrm — versions < 7.15.2, >= 8.0.0, < 8.10.2
Weakness classification (CWE)
References
- https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68
- https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2
- https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c
- https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2
- https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-7cj5-pc2f-9xgv
Frequently asked questions
- What is CVE-2026-61651?
- CVE-2026-61651 is a high-severity vulnerability in Suitecrm, classified under SQL Injection. CVSS score: 8.3/10. Published 2026-11-05.
- How severe is CVE-2026-61651?
- High severity. CVSS v3 base score is 8.3 out of 10.