CVE-2026-29099

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()` function in `include/OutboundEmail/OutboundEmail.php` fails to properly neutralize the user controlled `$id` parameter. It is assumed that the function calling `retrieve()` will appropriately quote and sanitize the user input. However, two locations have been identified that can be reached through the `EmailUIAjax` action on the `Email()` module where this is not the case. As such, it is possible for an authenticated user to perform SQL injection through the `retrieve()` function. This affects the latest major versions 7.15 and 8.9. As there do not appear to be restrictions on which tables can be called, it would be possible for an attacker to retrieve arbitrary information from the database, including user information and password hashes. Versions 7.15.1 and 8.9.3 patch the issue.

• CWE-89

• https://docs.suitecrm.com/admin/releases/7.15.xRelease Notes
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-38rf-h37x-7767Vendor Advisory

Published

Mar 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29091Locutus brings stdlibs of other programming languages to Jav…8.1
• CVE-2026-29092Kiteworks is a private data network (PDN). Prior to version …7.5
• CVE-2026-29093WWBN AVideo is an open source video platform. Prior to versi…9.8
• CVE-2026-29096SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5
• CVE-2026-29097SuiteCRM is an open-source, enterprise-ready Customer Relati…7.5
• CVE-2026-29098SuiteCRM is an open-source, enterprise-ready Customer Relati…4.9
• CVE-2026-2910A flaw has been found in Tenda HG9 300001138. This vulnerabi…8.8
• CVE-2026-29100SuiteCRM is an open-source, enterprise-ready Customer Relati…6.1
• CVE-2026-29101SuiteCRM is an open-source, enterprise-ready Customer Relati…7.5
• CVE-2026-29102SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2026-29103SuiteCRM is an open-source, enterprise-ready Customer Relati…7.2
• CVE-2026-29104SuiteCRM is an open-source, enterprise-ready Customer Relati…2.7