SuiteCRM: SQL injection via search param in modules/Cases/controller.php
cve-program · CVE-2026-69141
PublishedSuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CasesController action_get_kb_articles action interpolates $_POST['search'] into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Cases module access can perform blind SQL injection and extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-69141 · CVE overview and exploitation status
cve-program · CVE-2026-69141
- https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-wphj-qjgj-4j23
- https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-rc6r-hwhg-7pfg
- https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68
- https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c
- https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2
- https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2
Related changes
Linked by CVE identifier- SuiteCRM: SQL injection via search param in modules/Cases/controller.php · Newly collected advisory · 5 Nov 2026
- SuiteCRM: SQL injection via search param in modules/Cases/controller.php · Advisory content revised · 5 Nov 2026