Skip to content
OpenAdvisories
High WID-SEC-2026-0792 18 CVEs

SuiteCRM: Mehrere Schwachstellen

Published Mar 18, 2026 · Updated Mar 19, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in SuiteCRM ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Server-Side Request Forgery durchzuführen, Phishing-Angriffe zu starten oder einen Denial-of-Service-Zustand herbeizuführen.

Product

SuiteCRM ist eine Open-Source-Customer-Relationship-Management-Anwendung (CRM) zur Verwaltung von Kundenbeziehungen.

Vulnerabilities 18

  • Critical 9.1
    CVE-2026-29103

    SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Critical Remote Code Execution (RCE) vulnerability exists in SuiteCRM 7.15.0 and 8.9.2, allowing authenticated administrators to execute arbitrary syst…

    Suite CRM SuiteCRM
  • High 8.8
    CVE-2026-29099

    SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()` function in `include/OutboundEmail/OutboundEmail.php` fails to properly neutralize the user controll…

    Suite CRM SuiteCRM
  • High 8.8
    CVE-2026-33288

    SuiteCRM has Authenticated SQL Injection in Authentication Module

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a SQL Injection vulnerability exists in the SuiteCRM authentication mechanisms when directory support is enabled. The…

    Suite CRM SuiteCRM
  • High 8.8
    CVE-2026-33289

    SuiterCRM has LDAP Filter Injection in Authentication Module

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection vulnerability exists in the SuiteCRM authentication flow. The application fails to properly sanitiz…

    Suite CRM SuiteCRM
  • High 8.6
    CVE-2026-29109

    SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to and including 8.9.2 contain an unsafe deserialization vulnerability in the SavedSearch filter processing component that allows an authenti…

    Suite CRM SuiteCRM-Core
  • High 8.1
    CVE-2026-29096

    SuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report Fields

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, when creating or editing a report (AOR_Reports module), the `field_function` parameter from POST data is saved direct…

    Suite CRM SuiteCRM
  • High 8.1
    CVE-2026-29189

    SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL (Access Control List) checks on several endpoints, allowing authenticated us…

    Suite CRM SuiteCRM
  • High 7.2
    CVE-2026-29102

    SuiteCRM has Authenticated RCE in Modules

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an Authenticated Remote Code Execution (RCE) vulnerability exists in SuiteCRM modules. Versions 7.15.1 and 8.9.3 patc…

    Suite CRM SuiteCRM
  • High 7.1
    CVE-2026-29097

    SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions prior to 7.15.1 and 8.9.3 contain a Server-Side Request Forgery (SSRF) vulnerability combined with a Denial of Service (DoS) condition in the RS…

    Suite CRM SuiteCRM
  • High 7.1
    CVE-2026-29100

    SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM 7.15.0 contains a reflected HTML injection vulnerability in the login page that allows attackers to inject arbitrary HTML content, enabling phis…

    Suite CRM SuiteCRM
  • Medium 6.5
    CVE-2026-29108

    Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, an authenticated API endpoint allows any user to retrieve detailed information about any other user, including their password ha…

    Suite CRM SuiteCRM-Core
  • Medium 6.5
    CVE-2026-32697

    SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the `RecordHandler::getRecord()` method retrieves any record by module and ID without checking the current user's ACL view permi…

    Suite CRM SuiteCRM-Core
  • Medium 5.9
    CVE-2026-29106

    SuiteCRM has blind XSS in return_id parameter

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the value of the return_id request parameter is copied into the value of an HTML tag attribute which is an event hand…

    Suite CRM SuiteCRM
  • Medium 5.4
    CVE-2026-29105

    SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains an unauthenticated open redirect vulnerability in the WebToLead capture functionality. A user-suppl…

    Suite CRM SuiteCRM
  • Medium 5.0
    CVE-2026-29107

    SuiteCRM vulnerable to authenticated SSRF via PDF export

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, it is possible to create PDF templates with `<img>` tags. When a PDF is exported using this template, the content (fo…

    Suite CRM SuiteCRM
  • Medium 4.9
    CVE-2026-29098

    SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `action_exportCustom` function in `modules/ModuleBuilder/controller.php` fails to properly neutralize path traver…

    Suite CRM SuiteCRM
  • Medium 4.9
    CVE-2026-29101

    SuiteCRM Vulnerable to Directory Traversal to DoS in Modules

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a Denial-of-Service (DoS) vulnerability exists in SuiteCRM modules. Versions 7.15.1 and 8.9.3 patch the issue.

    Suite CRM SuiteCRM
  • Low 2.7
    CVE-2026-29104

    SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains an authenticated arbitrary file upload vulnerability in the Configurator module. An authenticated a…

    Suite CRM SuiteCRM

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-13365, EUVD-2026-13362, EUVD-2026-13361, EUVD-2026-13359, EUVD-2026-13355, EUVD-2026-13357, EUVD-2026-13351, EUVD-2026-13371, EUVD-2026-13369, EUVD-2026-13367, EUVD-2026-13353, EUVD-2026-13380, EUVD-2026-13374, EUVD-2026-13372, EUVD-2026-13400, EUVD-2026-13398, EUVD-2026-13376, EUVD-2026-13364

  2. #1

    Initiale Fassung

References