Vulnerability · Published Mar 19, 2026 · Assigned by GitHub_M
CVE-2026-29099SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.
High 8.8
In plain English
A high-severity SQL injection in SuiteCRM from SuiteCRM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Official description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()` function in `include/OutboundEmail/OutboundEmail.php` fails to properly neutralize the user controlled `$id` parameter. It is assumed that the function calling `retrieve()` will appropriately quote and sanitize the user input. However, two locations have been identified that can be reached through the `EmailUIAjax` action on the `Email()` module where this is not the case. As such, it is possible for an authenticated user to perform SQL injection through the `retrieve()` function. This affects the latest major versions 7.15 and 8.9. As there do not appear to be restrictions on which tables can be called, it would be possible for an attacker to retrieve arbitrary information from the database, including user information and password hashes. Versions 7.15.1 and 8.9.3 patch the issue.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-38rf-h37x-7767 x_refsource_CONFIRM
- https://docs.suitecrm.com/admin/releases/7.15.x x_refsource_MISC