CVE-2026-69141

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The action get kb articles action within the CasesController interpolates the search parameter from a POST request into a SQL WHERE clause and a CASE WHEN ... LIKE expression. A flaw in the securexss() function allows an input prefixed with an XSS payload to bypass entity-encoding of quotes, enabling a literal quote to reach the database query. This allows a low-privileged user with access to the Cases module to perform blind SQL injection—a technique used to extract data from a database by asking true/false questions—and retrieve sensitive information.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.