CVE-2026-63214 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's legacy REST endpoint appends a caller's query parameter as a raw SQL WHERE clause without enough validation. An authenticated user with list permission on a module can bypass the user_hash filter, read password hashes and other database data, and use recovered admin credentials to take over the application.
first public Jul 31, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any SuiteCRM instance running a version before 7.15.2 or 8.10.2 that exposes the legacy REST endpoint at /service/v4_1/rest.php is exposed. The attacker needs a valid account with list permission on at least one module, so instances without untrusted user accounts carry less risk, but a compromised low-privilege account is enough to escalate.
Not affected if no-legacy-rest-endpoint, patched-version
Who cares php, rest-api, self-hosted, suitecrm
7.15.2 (7.x line) and 8.10.2 (8.x line)./service/v4_1/rest.php using get_entry_list, get_entries_count or query in web server access logs.7.15.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause after insufficient structural validation. The affected flow begins at /service/v4_1/rest.php and uses get_entry_list, get_entries_count, and query to carry attacker-controlled data or authorization state into the security-sensitive operation. An account with list permission on a module can bypass the user_hash filter, retrieve password hashes and other database data, and use recovered administrative credentials to compromise the application. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
8.10.2NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.