CVE-2026-69134

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description An authenticated user can perform SQL injection through relationship fields to read or modify database information. This occurs because the REST v4 JSON handler reads the RAW REQUEST value, and relationship write helpers interpolate provided field values into INSERT and UPDATE statements. The data flow involves $GLOBALS['RAW REQUEST'] and utilizes the functions set relationship(), SugarRelationship::addRow(), SugarRelationship::updateRow(), and contact role to pass attacker-controlled data into security-sensitive operations. If the database account possesses elevated privileges, this may lead to unauthorized file-write operations.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.