CVE-2026-69140 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's document revision handler places user input directly into an SQL UPDATE statement, and a crafted XSS-prefixed input lets a literal quote through the sanitizer. A low-privileged user with Documents access can read database data and mass-update linked document records.
first public Aug 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted SuiteCRM installations on versions before 7.15.2 and 8.10.2 are exposed to any logged-in user with access to the Documents module. The flaw is in the revision handling code, so instances that never use that path are still on the same vulnerable code; the sources do not describe any configuration that avoids it.
Not affected if no-documents-module-users, patched-version
Who cares php, self-hosted, sql, suitecrm
7.15.x below 7.15.2 or 8.x below 8.10.2 is affected.7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates get_latest_for_id directly into an SQL UPDATE statement. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Documents module access can disclose database data and mass-update linked_documents records, while stacked statements and arbitrary DROP or INSERT operations are not supported by this vector. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.