{"id":"CVE-2026-71548","kind":"vulnerability","aliases":["CVE-2026-71548"],"related":[],"title":"SuiteCRM: authenticated report editors can read the entire database via SQL injection","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when value_type=Field without sufficient validation. An authenticated user who can save a report can use SQL injection to read the entire SuiteCRM database. Disclosed data can include users.user_hash, OAuth2 tokens, CRM records, report definitions, and configuration data; the connector does not permit stacked queries, so direct write-through-injection is not supported. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's report builder does not validate a field-type parameter before putting it into a SQL query, so a logged-in user who can save a report can inject SQL. An attacker can read the whole database, including password hashes, OAuth2 tokens and CRM records.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","package","php","self-hosted","suitecrm"],"not_affected_if":["fixed-version","no-report-editor-users"],"how_to_check":"- Check the SuiteCRM version in the admin panel or in the installed code; versions before `7.15.2` (7.x line) and before `8.10.2` (8.x line) are affected.\n- Confirm who holds report-editing rights in SuiteCRM; those users are the ones who could exploit this.","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:17:26+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","triaged_at":"2026-11-05T19:42:34+00:00","updated_at":"2026-11-05T19:42:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T19:42:34Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"network","title":"SuiteCRM: authenticated report editors can read the entire database via SQL injection","impact":"high","summary":"SuiteCRM's report builder does not validate a field-type parameter before putting it into a SQL query, so a logged-in user who can save a report can inject SQL. An attacker can read the whole database, including password hashes, OAuth2 tokens and CRM records.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php","crm"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads the entire database, including password hashes and OAuth tokens","analyst_note":"","how_to_check":"- Check the SuiteCRM version in the admin panel or in the installed code; versions before `7.15.2` (7.x line) and before `8.10.2` (8.x line) are affected.\n- Confirm who holds report-editing rights in SuiteCRM; those users are the ones who could exploit this.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-report-editor-users"],"who_is_affected":"Any SuiteCRM instance before 7.15.2 or 8.10.2 where at least one user can save reports is exposed. The flaw requires a valid login, so instances with only admin-locked or no user accounts are lower risk. Hosted SuiteCRM instances depend on the vendor applying the patch.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4416,"output_tokens":588,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-71548':15A,18A '7.15.2':91C,169C '8.10.2':93C,171C 'aor':94C 'applic':88C 'attack':60B 'authent':2A,115C 'build':96C 'builder':29B 'configur':145C 'connector':148C 'crm':19B,72B,86C,140C 'custom':83C 'cve':13A,16A 'data':133C,146C 'databas':9A,65B,131C 'definit':143C 'direct':155C 'disclos':132C 'editor':4A,103C 'enterpris':81C 'enterprise-readi':80C 'entir':8A,129C 'field':35B,110C 'field-typ':34B 'fix':166C 'hash':68B,137C 'host':24B 'includ':66B,135C 'incorpor':100C 'inject':12A,57B,125C,159C 'issu':164C 'log':48B 'logged-in':47B 'manag':85C 'oauth2':69B,138C 'open':78C 'open-sourc':77C 'packag':20B 'paramet':37B,105C 'password':67B 'permit':151C 'php':21B 'prior':89C 'put':39B 'queri':44B,98C,153C 'read':6A,62B,127C 'readi':82C 'record':73B,141C 'relationship':84C 'report':3A,28B,55B,95C,97C,102C,121C,142C 'save':53B,119C 'self':23B 'self-host':22B 'softwar':87C 'sourc':79C 'sql':11A,43B,58B,124C 'stack':152C 'suffici':112C 'suitecrm':1A,25B,26B,74C,130C 'support':162C 'token':70B,139C 'type':36B,109C 'use':123C 'user':50B,116C 'users.user':136C 'valid':32B,113C 'valu':106C,108C 'version':168C 'via':10A 'whole':64B 'without':111C 'write':157C 'write-through-inject':156C","nicknames":[],"mitigations":[],"who_affected":"Any SuiteCRM instance before 7.15.2 or 8.10.2 where at least one user can save reports is exposed. The flaw requires a valid login, so instances with only admin-locked or no user accounts are lower risk. Hosted SuiteCRM instances depend on the vendor applying the patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crm","high","package","php","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-08-17T16:49:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-71548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71548","severity":null,"published_at":"2026-11-05T19:17:26+00:00","modified_at":"2026-11-05T19:17:26+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","fetched_at":"2026-11-05T19:40:38+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79333,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-239h-ffjr-v957","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-17T16:49:06+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}