---
id: "CVE-2026-69142"
kind: "vulnerability"
aliases: ["CVE-2026-69142"]
title: "SuiteCRM: map marker distance parameter enables SQL injection by logged-in users"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "sql", "suitecrm"]
not_affected_if: ["managed-hosting", "maps-module-disabled", "patched-version"]
published_at: "2026-11-05T19:17:25+00:00"
first_seen_at: "2026-11-05T19:40:38+00:00"
updated_at: "2026-11-05T19:42:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69142", "first_seen_at": "2026-11-05T19:40:38+00:00"}]
exploit_sources: []
---

# SuiteCRM: map marker distance parameter enables SQL injection by logged-in users

SuiteCRM's map marker endpoint in the jjwg_Maps module passes the distance value into a SQL query without strict numeric validation. An authenticated user can change the query to read database contents, alter results, and consume server resources.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the SuiteCRM version in the installation (for example, the version shown in the admin area or `config.php`).
- Confirm whether the Maps module (jjwg_Maps) is enabled.

## Fix

- SuiteCRM 7.x: move to `7.15.2`
- SuiteCRM 8.x: move to `8.10.2`

## Timeline

- 2026-11-05T19:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-69142

## Documents

- [advisory] Vendor advisory: github.com https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-pjc8-2w2x-xcgf
- [fix] Patch: github.com https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68
- [fix] Release notes: github.com https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2
- [fix] Patch: github.com https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c
- [fix] Release notes: github.com https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2

## From the sources

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_