CVE-2026-63215 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's REST API v4.1 get_entry_list method can be abused for time-based blind SQL injection by an authenticated caller who bypasses two security controls at once. A successful attacker can extract sensitive data from the database.
first public Jul 31, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running self-hosted SuiteCRM 7 before 7.15.2 or SuiteCRM 8 before 8.10.2 that expose the REST API v4.1 to authenticated users. The advisory does not name the two bypassed controls, so exposure depends on which accounts can call the API. Instances on fixed versions or with the API unreachable are not affected.
Not affected if api-disabled, fixed-version
Who cares rest-api, self-hosted, suitecrm
7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 get_entry_list method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security mechanisms. The advisory does not identify those controls more precisely, so their identities remain unspecified. Successful exploitation can extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.