CVE-2026-97377 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's legacy SOAP portal_get_entry_list method builds SQL queries from caller-supplied where and order_by values without proper neutralization. A low-privileged portal API user can use blind SQL injection to read database metadata and sensitive records.
first public Oct 12, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running self-hosted SuiteCRM before 7.15.2 or 8.10.2 that expose the legacy SOAP portal API to portal users. Exposure depends on whether the portal API is in use; instances without portal API users can skip it. The sources do not say whether the portal API is enabled by default.
Not affected if managed-hosting, portal-api-disabled
Who cares crm, self-hosted, sql-injection, suitecrm
7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.