{"id":"CVE-2026-69145","kind":"vulnerability","aliases":["CVE-2026-69145"],"related":[],"title":"SuiteCRM: stored report field lets authenticated users inject SQL","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL without strict field validation. An authenticated user able to configure reports can inject SQL through that stored field value and disclose database contents. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's AOR report generator concatenates a stored field value into report SQL without strict validation. An authenticated user who can configure reports can use this to read database contents.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","package","php","self-hosted","suitecrm"],"not_affected_if":["no-report-builder-users","patched-version"],"how_to_check":"- Check the installed SuiteCRM version against the ranges below (for example, look at the version file or admin console).\n- Confirm whether users outside administrators can create or edit AOR reports.","fix":"- SuiteCRM 7.x: `7.15.2`\n- SuiteCRM 8.x: `8.10.2`","status":"open","published_at":"2026-11-05T19:17:26+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","triaged_at":"2026-11-05T19:43:17+00:00","updated_at":"2026-11-05T19:43:17+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T19:43:17Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: `7.15.2`\n- SuiteCRM 8.x: `8.10.2`","reach":"network","title":"SuiteCRM: stored report field lets authenticated users inject SQL","impact":"medium","summary":"SuiteCRM's AOR report generator concatenates a stored field value into report SQL without strict validation. An authenticated user who can configure reports can use this to read database contents.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php","mysql"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads database contents through report SQL","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version against the ranges below (for example, look at the version file or admin console).\n- Confirm whether users outside administrators can create or edit AOR reports.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-report-builder-users"],"who_is_affected":"SuiteCRM installations before 7.15.2 and before 8.10.2 are affected. The attack needs a logged-in account that can configure AOR reports, so teams that restrict report editing to trusted administrators have a lower exposure. Self-hosted instances are the main concern; check who holds report-building permissions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4345,"output_tokens":510,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-69145':12A,15A '7.15.2':70C,117C '8.10.2':72C,119C 'abl':95C 'aor':25B,73C 'aor_fields.field':81C 'applic':67C 'authent':6A,40B,93C 'concaten':28B,83C 'configur':44B,97C 'content':52B,110C 'crm':65C 'custom':62C 'cve':10A,13A 'databas':51B,109C 'disclos':108C 'enterpris':60C 'enterprise-readi':59C 'field':4A,31B,90C,105C 'fix':114C 'generat':27B,75C 'host':21B 'inject':8A,100C 'issu':112C 'let':5A 'manag':64C 'mysql':16B 'open':57C 'open-sourc':56C 'packag':17B 'php':18B 'prior':68C 'read':50B 'readi':61C 'relationship':63C 'reload':76C 'report':3A,26B,34B,45B,74C,86C,98C 'self':20B 'self-host':19B 'softwar':66C 'sourc':58C 'sql':9A,35B,87C,101C 'store':2A,30B,79C,104C 'strict':37B,89C 'suitecrm':1A,22B,23B,53C 'use':47B 'user':7A,41B,94C 'valid':38B,91C 'valu':32B,78C,106C 'version':116C 'without':36B,88C","nicknames":[],"mitigations":[],"who_affected":"SuiteCRM installations before 7.15.2 and before 8.10.2 are affected. The attack needs a logged-in account that can configure AOR reports, so teams that restrict report editing to trusted administrators have a lower exposure. Self-hosted instances are the main concern; check who holds report-building permissions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mysql","package","php","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-08-05T11:48:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-69145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69145","severity":null,"published_at":"2026-11-05T19:17:26+00:00","modified_at":"2026-11-05T19:17:26+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","fetched_at":"2026-11-05T19:40:38+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79328,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-4fhr-x4wr-fwqg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-05T11:48:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}