CVE-2026-61651

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61651
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61651.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61651
Aliases
  • GHSA-7cj5-pc2f-9xgv
Published
2026-11-05T18:10:35Z
Modified
2026-11-05T21:32:26Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
Summary
SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller
Details

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the get_end_date action in Projects Controller concatenates an authenticated caller's task_id value into a SQL query without parameterization. A low-privileged user can use blind SQL injection to enumerate the database schema and extract credentials, customer records, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61651.json"
}
References

Affected packages

Git / github.com/suitecrm/suitecrm

Affected ranges

Type
GIT
Repo
https://github.com/suitecrm/suitecrm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d6bca97a0159ec019a969b86eca32affab3beb7c
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "7.15.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "d6bca97a0159ec019a969b86eca32affab3beb7c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v7.15.2",
            "range": [
                {
                    "fixed": "d6bca97a0159ec019a969b86eca32affab3beb7c"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

7.*
7.9.6
v.*
v.7.9.11
v7.*
v7.0.2
v7.1
v7.1.1
v7.1.2
v7.1.3
v7.1.4
v7.10.0
v7.10.1
v7.10.10
v7.10.11
v7.10.12
v7.10.2
v7.10.3
v7.10.4
v7.10.5
v7.10.6
v7.10.7
v7.11.0
v7.11.1
v7.11.11
v7.11.12
v7.11.13
v7.11.14
v7.11.15
v7.11.16
v7.11.17
v7.11.18
v7.11.2
v7.11.3
v7.11.4
v7.11.5
v7.11.6
v7.11.7
v7.11.8
v7.12-rc
v7.12.0
v7.12.1
v7.12.2
v7.12.3
v7.12.4
v7.12.5
v7.12.6
v7.12.7
v7.12.8
v7.13.0
v7.13.0-beta
v7.13.1
v7.13.2
v7.13.3
v7.13.4
v7.14.0
v7.14.0-beta
v7.14.1
v7.14.2
v7.14.3
v7.14.4
v7.14.5
v7.14.6
v7.14.7
v7.14.8
v7.15.0
v7.15.1
v7.2
v7.2.1
v7.2beta
v7.2beta2
v7.3
v7.3-beta
v7.3.1
v7.3.2
v7.4.1
v7.4.2
v7.4.3
v7.5-beta
v7.5-beta.2
v7.5.1
v7.6
v7.6.1
v7.7
v7.7-beta1
v7.7-beta2
v7.7-rc
v7.7-rc2
v7.7.2
v7.7.3
v7.7.4
v7.8.0
v7.8.0-beta
v7.8.0-beta.2
v7.8.0-rc
v7.8.1
v7.8.2
v7.9.0
v7.9.0-beta
v7.9.0-rc
v7.9.1
v7.9.10
v7.9.11
v7.9.12
v7.9.13
v7.9.14
v7.9.3
v7.9.4
v7.9.5
v7.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61651.json"

Git / github.com/suitecrm/suitecrm-core

Affected ranges

Type
GIT
Repo
https://github.com/suitecrm/suitecrm-core
Events
Introduced
55c1ee9cbdf409ed41c04da0bbf442b311a3ab57
Fixed
6c7ce002a8f9b594eb80021d273af0aee72af54a
Fixed
a11f50180d939f639cc468b5d536e8ad714dfb68
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.10.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "a11f50180d939f639cc468b5d536e8ad714dfb68"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v8.10.2",
            "range": [
                {
                    "fixed": "6c7ce002a8f9b594eb80021d273af0aee72af54a"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v8.*
v8.0.0
v8.0.1
v8.0.2
v8.0.3
v8.0.4
v8.1.0
v8.1.1
v8.1.2
v8.1.3
v8.10.0
v8.10.1
v8.2.0
v8.2.0-beta.2
v8.2.1
v8.2.2
v8.2.3
v8.2.4
v8.3.0
v8.3.1
v8.4.0
v8.4.0-beta
v8.4.1
v8.4.2
v8.5.0
v8.5.1
v8.6.0
v8.6.1
v8.6.2
v8.7.0
v8.7.0-beta
v8.7.1
v8.8.0
v8.8.0-beta
v8.8.1
v8.9.0
v8.9.1
v8.9.2
v8.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61651.json"