CVE-2026-100365

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description An issue exists in AOR report generation where an attacker-controlled stored field label is concatenated into an ORDER BY clause without an allowlist. The affected flow starts at AOR Reports and utilizes aor fields, ORDER BY, and field label to inject data into a security-sensitive operation. An authenticated user with AOR Reports access can perform time-based extraction of password hashes and arbitrary table data, or maintain database connections using expensive expressions.

Recommendations Update SuiteCRM to version 7.15.2 or later. Update SuiteCRM to version 8.10.2 or later.