CVE-2026-63215

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The REST API v4.1 get entry list method is susceptible to time-based blind SQL injection, a technique where an attacker asks the database true/false questions and determines the answer based on the time the server takes to respond. This occurs when an authenticated caller bypasses two independent security mechanisms. Successful exploitation allows for the extraction of sensitive database information.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.