CVE-2026-29099
- Source
- https://cve.org/CVERecord?id=CVE-2026-29099
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29099.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-29099
- Aliases
-
- GHSA-38rf-h37x-7767
- Published
- 2026-03-19T22:46:56.418Z
- Modified
- 2026-04-10T05:41:29.738845Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.
- Details
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the
retrieve()function ininclude/OutboundEmail/OutboundEmail.phpfails to properly neutralize the user controlled$idparameter. It is assumed that the function callingretrieve()will appropriately quote and sanitize the user input. However, two locations have been identified that can be reached through theEmailUIAjaxaction on theEmail()module where this is not the case. As such, it is possible for an authenticated user to perform SQL injection through theretrieve()function. This affects the latest major versions 7.15 and 8.9. As there do not appear to be restrictions on which tables can be called, it would be possible for an attacker to retrieve arbitrary information from the database, including user information and password hashes. Versions 7.15.1 and 8.9.3 patch the issue. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-89" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29099.json" }- References