CVE-2026-63214

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause after insufficient structural validation. The affected flow begins at /service/v4_1/rest.php and uses get_entry_list, get_entries_count, and query to carry attacker-controlled data or authorization state into the security-sensitive operation. An account with list permission on a module can bypass the user_hash filter, retrieve password hashes and other database data, and use recovered administrative credentials to compromise the application. This issue is fixed in versions 7.15.2 and 8.10.2.

• CWE-89
• CWE-943

• https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68
• https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2
• https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c
• https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-gjgm-wrr6-hrmp

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63206Zammad is a web based open source helpdesk/customer support …5.3
• CVE-2026-63207Zammad is a web based open source helpdesk/customer support …6.9
• CVE-2026-63208Zammad is a web based open source helpdesk/customer support …5.1
• CVE-2026-63209compress provides various compression algorithms. Prior to v…7.5
• CVE-2026-6321fast-uri decoded percent-encoded path separators and dot seg…7.5
• CVE-2026-63213SuiteCRM is an open-source, enterprise-ready Customer Relati…7.2
• CVE-2026-63215SuiteCRM is an open-source, enterprise-ready Customer Relati…8.3
• CVE-2026-63216Zammad is a web based open source helpdesk/customer support …5.3
• CVE-2026-63217SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5
• CVE-2026-63218SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5
• CVE-2026-63219GeoNetwork is a catalog application to manage spatially refe…8.6
• CVE-2026-6322fast-uri normalize() decoded percent-encoded authority delim…7.5