CVE-2026-69136 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM passes the remove_attachment parameter into an SQL UPDATE statement without proper escaping, so an authenticated user can inject SQL. An attacker can read database contents or soft-delete every record in the notes table in one request.
first public Aug 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any SuiteCRM instance running a version before 7.15.2 or 8.10.2 where users can log in and use email template attachments. Exposure requires an account, so instances with tightly limited user access carry less risk, but the flaw still allows data disclosure and mass soft-deletion by any logged-in user.
Not affected if no-email-templates, patched-version
Who cares crm, php, self-hosted, suitecrm
version.php file; versions before 7.15.2 and 8.10.2 are affected7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the remove_attachment POST parameter array through HTML-oriented securexss() processing and directly interpolates its elements into an SQL UPDATE statement. An authenticated attacker can inject SQL to disclose database information or abuse the UPDATE context to soft-delete all records in the notes table in one request. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.