---
id: "CVE-2026-69145"
kind: "vulnerability"
aliases: ["CVE-2026-69145"]
title: "SuiteCRM: stored report field lets authenticated users inject SQL"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mysql", "package", "php", "self-hosted", "suitecrm"]
not_affected_if: ["no-report-builder-users", "patched-version"]
published_at: "2026-11-05T19:17:26+00:00"
first_seen_at: "2026-11-05T19:40:38+00:00"
updated_at: "2026-11-05T19:43:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69145", "first_seen_at": "2026-11-05T19:40:38+00:00"}]
exploit_sources: []
---

# SuiteCRM: stored report field lets authenticated users inject SQL

SuiteCRM's AOR report generator concatenates a stored field value into report SQL without strict validation. An authenticated user who can configure reports can use this to read database contents.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SuiteCRM version against the ranges below (for example, look at the version file or admin console).
- Confirm whether users outside administrators can create or edit AOR reports.

## Fix

- SuiteCRM 7.x: `7.15.2`
- SuiteCRM 8.x: `8.10.2`

## Timeline

- 2026-11-05T19:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-69145

## Documents

- [advisory] Vendor advisory: github.com https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-4fhr-x4wr-fwqg
- [fix] Patch: github.com https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68
- [fix] Release notes: github.com https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2
- [fix] Patch: github.com https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c
- [fix] Release notes: github.com https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2

## From the sources

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL without strict field validation. An authenticated user able to configure reports can inject SQL through that stored field value and disclose database contents. This issue is fixed in versions 7.15.2 and 8.10.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_