CVE-2026-69145 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's AOR report generator concatenates a stored field value into report SQL without strict validation. An authenticated user who can configure reports can use this to read database contents.
first public Aug 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
SuiteCRM installations before 7.15.2 and before 8.10.2 are affected. The attack needs a logged-in account that can configure AOR reports, so teams that restrict report editing to trusted administrators have a lower exposure. Self-hosted instances are the main concern; check who holds report-building permissions.
Not affected if no-report-builder-users, patched-version
Who cares mysql, php, self-hosted, suitecrm
7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL without strict field validation. An authenticated user able to configure reports can inject SQL through that stored field value and disclose database contents. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.