CVE-2026-69140

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description In the GetLatestRevision.php file, the get latest for id variable is interpolated directly into an SQL UPDATE statement. While the securexss() function typically encodes quotes, an input prefixed with an XSS payload can cause AntiXSS to select a processed string instead of the encoded backup, allowing a literal quote to reach the query. This allows a low-privileged user with access to the Documents module to disclose database data and perform mass updates to linked documents records. Stacked statements and arbitrary DROP or INSERT operations are not supported by this vector.

Recommendations Update SuiteCRM to version 7.15.2 or later. Update SuiteCRM to version 8.10.2 or later.