Vulnerability Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()` function in `include/OutboundEmail/OutboundEmail.php` fails to properly neutralize the user controlled `$id` parameter. It is assumed that the function calling `retrieve()` will appropriately quote and sanitize the user input. However, two locations have been identified that can be reached through the `EmailUIAjax` action on the `Email()` module where this is not the case. As such, it is possible for an authenticated user to perform SQL injection through the `retrieve()` function. This affects the latest major versions 7.15 and 8.9. As there do not appear to be restrictions on which tables can be called, it would be possible for an attacker to retrieve arbitrary information from the database, including user information and password hashes. Versions 7.15.1 and 8.9.3 patch the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Suitecrm | Suitecrm | < 7.15.1 |
Related Weaknesses (CWE)
References
- https://docs.suitecrm.com/admin/releases/7.15.xRelease Notes
- https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-38rf-h37x-7767Vendor Advisory
FAQ
What is CVE-2026-29099?
CVE-2026-29099 is a vulnerability with a CVSS score of 8.8 (HIGH). SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()` function in `include/OutboundEmail/Outbou...
How severe is CVE-2026-29099?
CVE-2026-29099 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-29099?
Check the references section above for vendor advisories and patch information. Affected products include: Suitecrm Suitecrm.