{"id":"CVE-2026-69140","kind":"vulnerability","aliases":["CVE-2026-69140"],"related":[],"title":"SuiteCRM: crafted input lets low-privilege users read and alter database records","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates get_latest_for_id directly into an SQL UPDATE statement. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Documents module access can disclose database data and mass-update linked_documents records, while stacked statements and arbitrary DROP or INSERT operations are not supported by this vector. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's document revision handler places user input directly into an SQL UPDATE statement, and a crafted XSS-prefixed input lets a literal quote through the sanitizer. A low-privileged user with Documents access can read database data and mass-update linked document records.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","sql","suitecrm"],"not_affected_if":["no-documents-module-users","patched-version"],"how_to_check":"- Check the installed SuiteCRM version in the application's version file or admin screen; `7.15.x` below `7.15.2` or `8.x` below `8.10.2` is affected.\n- Confirm whether users with Documents module access are untrusted or external accounts.","fix":"- SuiteCRM `7.15.2`\n- SuiteCRM `8.10.2`","status":"open","published_at":"2026-11-05T19:17:25+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","triaged_at":"2026-11-05T19:42:44+00:00","updated_at":"2026-11-05T19:42:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T19:42:44Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM `7.15.2`\n- SuiteCRM `8.10.2`","reach":"network","title":"SuiteCRM: crafted input lets low-privilege users read and alter database records","impact":"medium","summary":"SuiteCRM's document revision handler places user input directly into an SQL UPDATE statement, and a crafted XSS-prefixed input lets a literal quote through the sanitizer. A low-privileged user with Documents access can read database data and mass-update linked document records.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php","sql"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"database data disclosed and linked document records mass-updated","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version in the application's version file or admin screen; `7.15.x` below `7.15.2` or `8.x` below `8.10.2` is affected.\n- Confirm whether users with Documents module access are untrusted or external accounts.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-documents-module-users"],"who_is_affected":"Self-hosted SuiteCRM installations on versions before 7.15.2 and 8.10.2 are exposed to any logged-in user with access to the Documents module. The flaw is in the revision handling code, so instances that never use that path are still on the same vulnerable code; the sources do not describe any configuration that avoids it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4440,"output_tokens":561,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-69140':16A,19A '7.15.2':91C,180C '8.10.2':93C,182C 'access':62B,147C 'allow':131C 'alter':11A 'although':106C 'antixss':121C 'applic':88C 'arbitrari':163C 'backup':130C 'craft':2A,43B 'crm':86C 'custom':83C 'cve':14A,17A 'data':66B,151C 'databas':12A,65B,150C 'direct':35B,100C 'disclos':149C 'document':29B,61B,72B,145C,157C 'drop':164C 'encod':111C,129C 'enterpris':81C 'enterprise-readi':80C 'entiti':110C 'entity-encod':109C 'fix':177C 'get':96C 'getlatestrevision.php':94C 'handler':31B 'host':24B 'id':99C 'input':3A,34B,47B,114C 'insert':166C 'instead':126C 'interpol':95C 'issu':175C 'latest':97C 'let':4A,48B 'link':71B,156C 'liter':50B,133C 'low':6A,57B,141C 'low-privileg':5A,56B,140C 'make':120C 'manag':85C 'mass':69B,154C 'mass-upd':68B,153C 'modul':146C 'normal':108C 'open':78C 'open-sourc':77C 'oper':167C 'packag':20B 'payload':119C 'php':21B 'place':32B 'prefix':46B,115C 'prior':89C 'privileg':7A,58B,142C 'process':124C 'queri':138C 'quot':51B,112C,134C 'reach':136C 'read':9A,64B 'readi':82C 'record':13A,73B,158C 'relationship':84C 'revis':30B 'sanit':54B 'securexss':107C 'select':122C 'self':23B 'self-host':22B 'softwar':87C 'sourc':79C 'sql':25B,38B,103C 'stack':160C 'statement':40B,105C,161C 'string':125C 'suitecrm':1A,26B,27B,74C 'support':170C 'updat':39B,70B,104C,155C 'user':8A,33B,59B,143C 'vector':173C 'version':179C 'xss':45B,118C 'xss-prefix':44B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted SuiteCRM installations on versions before 7.15.2 and 8.10.2 are exposed to any logged-in user with access to the Documents module. The flaw is in the revision handling code, so instances that never use that path are still on the same vulnerable code; the sources do not describe any configuration that avoids it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","php","selfhosted","sql","suitecrm"],"campaign_type":null,"first_public_at":"2026-08-05T11:37:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-69140","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69140","severity":null,"published_at":"2026-11-05T19:17:25+00:00","modified_at":"2026-11-05T19:17:25+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","fetched_at":"2026-11-05T19:40:38+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79308,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-xg3m-xvc9-j55j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-05T11:37:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}