CVE-2026-61648

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description A low-privileged user with AOR Reports access can perform time-based or UNION-based SQL injection to read arbitrary tables and consume database connections using delay expressions. The issue occurs because a Multi report condition passes the parameter value variable through the unencodeMultienum() function and concatenates the result into a SQL WHERE clause. While securexss() typically encodes quotes, an input prefixed with an XSS payload causes AntiXSS to select a processed string instead of the encoded backup, allowing a literal quote to reach the database.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.