CVE-2026-61651

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The get end date action in the Projects Controller concatenates the task id variable into a SQL query without proper parameterization. This allows an authenticated low-privileged user to perform blind SQL injection, a technique used to extract information from a database by asking true or false questions, to enumerate the database schema and extract credentials, customer records, and other sensitive contents.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.