← CVE Radar
CVE-2026-69145SuiteCRM: AOR Reports aor_fields.field SQL Injection
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL without strict field validation. An authenticated user able to configure reports can inject SQL through that stored field value and disclose database contents. This issue is fixed in versions 7.15.2 and 8.10.2.
6.5 MEDIUMEPSS 0.26%Not in KEVNVD: Undergoing Analysis
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 6.5 | MEDIUM | 3.1GitHub_M (CNA) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Details
- CVE ID
- CVE-2026-69145
- Status
- Undergoing Analysis
- Assigner (CNA)
- GitHub_M
- Published
- Nov 5, 2026
- Last modified
- 2026-11-05 19:17 UTC
- Weaknesses
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
As published by the CNA in the CVE record.
SuiteCRMSuiteCRM2 version ranges
- < 7.15.2
- >= 8.0.0, < 8.10.2
References
- github.com https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68
- github.com https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2
- github.com https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c
- github.com https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2
- github.com https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-4fhr-x4wr-fwqg