{"id":"CVE-2026-63215","kind":"vulnerability","aliases":["CVE-2026-63215"],"related":[],"title":"SuiteCRM: REST API lets authenticated users run time-based SQL injection","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 get_entry_list method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security mechanisms. The advisory does not identify those controls more precisely, so their identities remain unspecified. Successful exploitation can extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's REST API v4.1 get_entry_list method can be abused for time-based blind SQL injection by an authenticated caller who bypasses two security controls at once. A successful attacker can extract sensitive data from the database.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","rest-api","self-hosted","suitecrm"],"not_affected_if":["api-disabled","fixed-version"],"how_to_check":"- Check the installed SuiteCRM version in the admin console or the version file, and compare it against the fixed versions below.\n- Confirm whether the REST API v4.1 is enabled and reachable by users with accounts.","fix":"- SuiteCRM 7.x: `7.15.2`\n- SuiteCRM 8.x: `8.10.2`","status":"open","published_at":"2026-11-05T19:17:23+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","triaged_at":"2026-11-05T19:42:47+00:00","updated_at":"2026-11-05T19:42:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T19:42:47Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: `7.15.2`\n- SuiteCRM 8.x: `8.10.2`","reach":"internet","title":"SuiteCRM: REST API lets authenticated users run time-based SQL injection","impact":"high","summary":"SuiteCRM's REST API v4.1 get_entry_list method can be abused for time-based blind SQL injection by an authenticated caller who bypasses two security controls at once. A successful attacker can extract sensitive data from the database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","rest-api"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker extracts sensitive database contents through blind SQL injection","analyst_note":"Identify the two security controls bypassed in get_entry_list, from the vendor advisory linked on github.com, to judge real exposure.","how_to_check":"- Check the installed SuiteCRM version in the admin console or the version file, and compare it against the fixed versions below.\n- Confirm whether the REST API v4.1 is enabled and reachable by users with accounts.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","api-disabled"],"who_is_affected":"Teams running self-hosted SuiteCRM 7 before 7.15.2 or SuiteCRM 8 before 8.10.2 that expose the REST API v4.1 to authenticated users. The advisory does not name the two bypassed controls, so exposure depends on which accounts can call the API. Instances on fixed versions or with the API unreachable are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000743,"input_tokens":4377,"output_tokens":610,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-63215':15A,18A '7.15.2':84C,141C '8.10.2':86C,143C 'abus':38B 'advisori':115C 'api':3A,22B,30B,89C 'applic':81C 'attack':59B 'authent':5A,48B,106C 'base':10A,42B,100C 'blind':43B,101C 'bypass':51B,109C 'caller':49B,107C 'control':54B,120C 'crm':79C 'custom':76C 'cve':13A,16A 'data':63B 'databas':66B,133C 'enterpris':74C 'enterprise-readi':73C 'entri':33B,92C 'exploit':129C 'extract':61B,131C 'fix':138C 'get':32B,91C 'host':25B 'ident':125C 'identifi':118C 'independ':111C 'inform':134C 'inject':12A,45B,103C 'issu':136C 'let':4A 'list':34B,93C 'manag':78C 'mechan':113C 'method':35B,94C 'open':71C 'open-sourc':70C 'packag':19B 'precis':122C 'prior':82C 'readi':75C 'relationship':77C 'remain':126C 'rest':2A,21B,29B,88C 'rest-api':20B 'run':7A 'secur':53B,112C 'self':24B 'self-host':23B 'sensit':62B,132C 'simultan':108C 'softwar':80C 'sourc':72C 'sql':11A,44B,102C 'success':58B,128C 'suitecrm':1A,26B,27B,67C 'time':9A,41B,99C 'time-bas':8A,40B,98C 'two':52B,110C 'unspecifi':127C 'user':6A 'v4.1':31B,90C 'version':140C 'vulner':96C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted SuiteCRM 7 before 7.15.2 or SuiteCRM 8 before 8.10.2 that expose the REST API v4.1 to authenticated users. The advisory does not name the two bypassed controls, so exposure depends on which accounts can call the API. Instances on fixed versions or with the API unreachable are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","restapi","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-07-31T14:39:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63215","severity":null,"published_at":"2026-11-05T19:17:23+00:00","modified_at":"2026-11-05T19:17:23+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","fetched_at":"2026-11-05T19:40:37+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79273,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-pmhw-r27f-w92m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-31T14:39:43+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}