CVE-2026-63214

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description Legacy REST methods fail to perform sufficient structural validation before appending an authenticated caller's query parameter as a SQL WHERE clause. This issue occurs at the '/service/v4 1/rest.php' endpoint and involves the get entry list, get entries count, and query functions. An account with list permissions on a module can bypass the user hash filter to retrieve password hashes and other sensitive database information, potentially allowing the use of administrative credentials to compromise the application.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.