CVE-2026-69136

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description Email template attachment handling improperly processes the remove attachment POST parameter array. The application passes this array through the securexss() function, which is designed for HTML security, and then directly interpolates the elements into an SQL UPDATE statement. This allows an authenticated attacker to perform SQL injection to disclose database information or soft-delete all records within the notes table in a single request.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.