---
id: "CVE-2026-97377"
kind: "vulnerability"
aliases: ["CVE-2026-97377"]
title: "SuiteCRM: SOAP portal method lets low-privilege users run blind SQL injection"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["crm", "package", "self-hosted", "sql-injection", "suitecrm"]
not_affected_if: ["managed-hosting", "portal-api-disabled"]
published_at: "2026-11-05T19:17:29+00:00"
first_seen_at: "2026-11-05T19:40:39+00:00"
updated_at: "2026-11-05T19:42:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97377", "first_seen_at": "2026-11-05T19:40:39+00:00"}]
exploit_sources: []
---

# SuiteCRM: SOAP portal method lets low-privilege users run blind SQL injection

SuiteCRM's legacy SOAP portal_get_entry_list method builds SQL queries from caller-supplied where and order_by values without proper neutralization. A low-privileged portal API user can use blind SQL injection to read database metadata and sensitive records.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SuiteCRM version and compare it with the fixed versions below.
- Check whether the legacy SOAP portal API is enabled and reachable by portal users.

## Fix

- SuiteCRM 7.x: move to `7.15.2`
- SuiteCRM 8.x: move to `8.10.2`

## Timeline

- 2026-11-05T19:40:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97377

## Documents

- [advisory] Vendor advisory: github.com https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-2hv5-wj8h-mv8m
- [fix] Patch: github.com https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68
- [fix] Release notes: github.com https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2
- [fix] Patch: github.com https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c
- [fix] Release notes: github.com https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2

## From the sources

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_