{"id":"CVE-2026-69136","kind":"vulnerability","aliases":["CVE-2026-69136"],"related":[],"title":"SuiteCRM: email template attachment flaw lets logged-in users inject SQL","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the remove_attachment POST parameter array through HTML-oriented securexss() processing and directly interpolates its elements into an SQL UPDATE statement. An authenticated attacker can inject SQL to disclose database information or abuse the UPDATE context to soft-delete all records in the notes table in one request. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM passes the remove_attachment parameter into an SQL UPDATE statement without proper escaping, so an authenticated user can inject SQL. An attacker can read database contents or soft-delete every record in the notes table in one request.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","package","php","self-hosted","suitecrm"],"not_affected_if":["no-email-templates","patched-version"],"how_to_check":"- Check the installed SuiteCRM version in the admin panel or the `version.php` file; versions before `7.15.2` and `8.10.2` are affected\n- Confirm whether email template attachments are used in your instance","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:17:24+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","triaged_at":"2026-11-05T19:43:00+00:00","updated_at":"2026-11-05T19:43:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T19:43:00Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"internet","title":"SuiteCRM: email template attachment flaw lets logged-in users inject SQL","impact":"high","summary":"SuiteCRM passes the remove_attachment parameter into an SQL UPDATE statement without proper escaping, so an authenticated user can inject SQL. An attacker can read database contents or soft-delete every record in the notes table in one request.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php","crm"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"database contents read and notes records soft-deleted","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version in the admin panel or the `version.php` file; versions before `7.15.2` and `8.10.2` are affected\n- Confirm whether email template attachments are used in your instance","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-email-templates"],"who_is_affected":"Any SuiteCRM instance running a version before 7.15.2 or 8.10.2 where users can log in and use email template attachments. Exposure requires an account, so instances with tightly limited user access carry less risk, but the flaw still allows data disclosure and mass soft-deletion by any logged-in user.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000711,"input_tokens":4380,"output_tokens":546,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-69136':15A,18A '7.15.2':83C,147C '8.10.2':85C,149C 'abus':124C 'applic':80C 'array':96C 'attach':4A,30B,88C,93C 'attack':48B,115C 'authent':42B,114C 'content':52B 'context':127C 'crm':19B,78C 'custom':75C 'cve':13A,16A 'databas':51B,121C 'delet':56B,131C 'direct':104C 'disclos':120C 'element':107C 'email':2A,86C 'enterpris':73C 'enterprise-readi':72C 'escap':39B 'everi':57B 'fix':144C 'flaw':5A 'handl':89C 'host':24B 'html':99C 'html-orient':98C 'inform':122C 'inject':11A,45B,117C 'interpol':105C 'issu':142C 'let':6A 'log':8A 'logged-in':7A 'manag':77C 'note':61B,136C 'one':64B,139C 'open':70C 'open-sourc':69C 'orient':100C 'packag':20B 'paramet':31B,95C 'pass':27B,90C 'php':21B 'post':94C 'prior':81C 'process':102C 'proper':38B 'read':50B 'readi':74C 'record':58B,133C 'relationship':76C 'remov':29B,92C 'request':65B,140C 'securexss':101C 'self':23B 'self-host':22B 'soft':55B,130C 'soft-delet':54B,129C 'softwar':79C 'sourc':71C 'sql':12A,34B,46B,110C,118C 'statement':36B,112C 'suitecrm':1A,25B,26B,66C 'tabl':62B,137C 'templat':3A,87C 'updat':35B,111C,126C 'user':10A,43B 'version':146C 'without':37B","nicknames":[],"mitigations":[],"who_affected":"Any SuiteCRM instance running a version before 7.15.2 or 8.10.2 where users can log in and use email template attachments. Exposure requires an account, so instances with tightly limited user access carry less risk, but the flaw still allows data disclosure and mass soft-deletion by any logged-in user.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crm","high","package","php","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-08-05T11:33:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-69136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69136","severity":null,"published_at":"2026-11-05T19:17:24+00:00","modified_at":"2026-11-05T19:17:25+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","fetched_at":"2026-11-05T19:40:38+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79298,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-3mjp-45mc-3256","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-05T11:33:23+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}