CVE-2026-63215

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63215
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63215.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63215
Aliases
  • GHSA-pmhw-r27f-w92m
Published
2026-11-05T18:14:52Z
Modified
2026-11-05T21:32:25Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
Summary
SuiteCRM: Time-Based Blind SQL Injection via REST API
Details

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 get_entry_list method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security mechanisms. The advisory does not identify those controls more precisely, so their identities remain unspecified. Successful exploitation can extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63215.json"
}
References

Affected packages

Git / github.com/suitecrm/suitecrm

Affected ranges

Type
GIT
Repo
https://github.com/suitecrm/suitecrm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d6bca97a0159ec019a969b86eca32affab3beb7c
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "7.15.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "d6bca97a0159ec019a969b86eca32affab3beb7c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v7.15.2",
            "range": [
                {
                    "fixed": "d6bca97a0159ec019a969b86eca32affab3beb7c"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

7.*
7.9.6
v.*
v.7.9.11
v7.*
v7.0.2
v7.1
v7.1.1
v7.1.2
v7.1.3
v7.1.4
v7.10.0
v7.10.1
v7.10.10
v7.10.11
v7.10.12
v7.10.2
v7.10.3
v7.10.4
v7.10.5
v7.10.6
v7.10.7
v7.11.0
v7.11.1
v7.11.11
v7.11.12
v7.11.13
v7.11.14
v7.11.15
v7.11.16
v7.11.17
v7.11.18
v7.11.2
v7.11.3
v7.11.4
v7.11.5
v7.11.6
v7.11.7
v7.11.8
v7.12-rc
v7.12.0
v7.12.1
v7.12.2
v7.12.3
v7.12.4
v7.12.5
v7.12.6
v7.12.7
v7.12.8
v7.13.0
v7.13.0-beta
v7.13.1
v7.13.2
v7.13.3
v7.13.4
v7.14.0
v7.14.0-beta
v7.14.1
v7.14.2
v7.14.3
v7.14.4
v7.14.5
v7.14.6
v7.14.7
v7.14.8
v7.15.0
v7.15.1
v7.2
v7.2.1
v7.2beta
v7.2beta2
v7.3
v7.3-beta
v7.3.1
v7.3.2
v7.4.1
v7.4.2
v7.4.3
v7.5-beta
v7.5-beta.2
v7.5.1
v7.6
v7.6.1
v7.7
v7.7-beta1
v7.7-beta2
v7.7-rc
v7.7-rc2
v7.7.2
v7.7.3
v7.7.4
v7.8.0
v7.8.0-beta
v7.8.0-beta.2
v7.8.0-rc
v7.8.1
v7.8.2
v7.9.0
v7.9.0-beta
v7.9.0-rc
v7.9.1
v7.9.10
v7.9.11
v7.9.12
v7.9.13
v7.9.14
v7.9.3
v7.9.4
v7.9.5
v7.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63215.json"

Git / github.com/suitecrm/suitecrm-core

Affected ranges

Type
GIT
Repo
https://github.com/suitecrm/suitecrm-core
Events
Introduced
55c1ee9cbdf409ed41c04da0bbf442b311a3ab57
Fixed
6c7ce002a8f9b594eb80021d273af0aee72af54a
Fixed
a11f50180d939f639cc468b5d536e8ad714dfb68
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.10.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "a11f50180d939f639cc468b5d536e8ad714dfb68"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v8.10.2",
            "range": [
                {
                    "fixed": "6c7ce002a8f9b594eb80021d273af0aee72af54a"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v8.*
v8.0.0
v8.0.1
v8.0.2
v8.0.3
v8.0.4
v8.1.0
v8.1.1
v8.1.2
v8.1.3
v8.10.0
v8.10.1
v8.2.0
v8.2.0-beta.2
v8.2.1
v8.2.2
v8.2.3
v8.2.4
v8.3.0
v8.3.1
v8.4.0
v8.4.0-beta
v8.4.1
v8.4.2
v8.5.0
v8.5.1
v8.6.0
v8.6.1
v8.6.2
v8.7.0
v8.7.0-beta
v8.7.1
v8.8.0
v8.8.0-beta
v8.8.1
v8.9.0
v8.9.1
v8.9.2
v8.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63215.json"