CVE-2026-69135

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The Project module fails to properly sanitize, quote, or parameterize the duplicateId POST parameter before interpolating it into a SQL query. This allows an authenticated attacker to manipulate the query structure and disclose sensitive information from the database.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later. Restrict the use of the duplicateId parameter in the Project module until the updates are applied.