{"id":"CVE-2026-97377","kind":"vulnerability","aliases":["CVE-2026-97377"],"related":[],"title":"SuiteCRM: SOAP portal method lets low-privilege users run blind SQL injection","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's legacy SOAP portal_get_entry_list method builds SQL queries from caller-supplied where and order_by values without proper neutralization. A low-privileged portal API user can use blind SQL injection to read database metadata and sensitive records.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","package","self-hosted","sql-injection","suitecrm"],"not_affected_if":["managed-hosting","portal-api-disabled"],"how_to_check":"- Check the installed SuiteCRM version and compare it with the fixed versions below.\n- Check whether the legacy SOAP portal API is enabled and reachable by portal users.","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:17:29+00:00","first_seen_at":"2026-11-05T19:40:39+00:00","triaged_at":"2026-11-05T19:42:30+00:00","updated_at":"2026-11-05T19:42:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T19:42:30Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"internet","title":"SuiteCRM: SOAP portal method lets low-privilege users run blind SQL injection","impact":"high","summary":"SuiteCRM's legacy SOAP portal_get_entry_list method builds SQL queries from caller-supplied where and order_by values without proper neutralization. A low-privileged portal API user can use blind SQL injection to read database metadata and sensitive records.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","sql-injection","crm"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"database records and metadata readable by a low-privileged portal user","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version and compare it with the fixed versions below.\n- Check whether the legacy SOAP portal API is enabled and reachable by portal users.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","portal-api-disabled"],"who_is_affected":"Organizations running self-hosted SuiteCRM before 7.15.2 or 8.10.2 that expose the legacy SOAP portal API to portal users. Exposure depends on whether the portal API is in use; instances without portal API users can skip it. The sources do not say whether the portal API is enabled by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4373,"output_tokens":555,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-97377':16A,19A '7.15.2':89C,148C '8.10.2':91C,150C 'affect':136C 'api':58B,122C 'applic':86C 'behavior':138C 'blind':11A,62B,126C 'build':38B 'caller':43B,103C 'caller-control':102C 'caller-suppli':42B 'construct':113C 'consum':140C 'control':104C 'crm':20B,84C 'custom':81C 'cve':14A,17A 'databas':67B,131C 'disclos':130C 'enterpris':79C 'enterprise-readi':78C 'entri':35B,99C 'fix':145C 'get':34B,98C 'host':24B 'inject':13A,27B,64B,128C 'issu':143C 'legaci':31B,93C 'let':5A 'list':36B,100C 'low':7A,55B,119C 'low-privileg':6A,54B,118C 'manag':83C 'metadata':68B,132C 'method':4A,37B,96C 'neutral':52B,116C 'open':76C 'open-sourc':75C 'order':47B,107C 'packag':21B 'perform':125C 'portal':3A,33B,57B,95C,97C,121C 'prior':87C 'privileg':8A,56B,120C 'propag':101C 'proper':51B 'queri':40B,112C,137C 'read':66B 'readi':80C 'record':71B,135C 'relationship':82C 'resourc':141C 'run':10A 'self':23B 'self-host':22B 'sensit':70B,134C 'soap':2A,32B,94C 'softwar':85C 'sourc':77C 'sql':12A,26B,39B,63B,111C,127C 'sql-inject':25B 'suffici':115C 'suitecrm':1A,28B,29B,72C 'suppli':44B 'use':61B 'user':9A,59B,123C 'valu':49B,109C 'version':147C 'without':50B,114C","nicknames":[],"mitigations":[],"who_affected":"Organizations running self-hosted SuiteCRM before 7.15.2 or 8.10.2 that expose the legacy SOAP portal API to portal users. Exposure depends on whether the portal API is in use; instances without portal API users can skip it. The sources do not say whether the portal API is enabled by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crm","high","package","selfhosted","sqlinjection","suitecrm"],"campaign_type":null,"first_public_at":"2026-10-12T17:45:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97377","severity":null,"published_at":"2026-11-05T19:17:29+00:00","modified_at":"2026-11-05T19:17:29+00:00","first_seen_at":"2026-11-05T19:40:39+00:00","fetched_at":"2026-11-05T19:40:39+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79343,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-2hv5-wj8h-mv8m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-12T17:45:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}