CVE-2026-100359

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The Project Template module contains a blind SQL injection flaw. The action get end date() function fails to sanitize, parameterize, or escape the task id and lag POST parameters. This allows an authenticated user to execute arbitrary SQL queries to access sensitive information, including customer data, internal communications, and credentials.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later. As a temporary mitigation, restrict access to the Project Template module.