CVE-2026-97377

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The legacy SOAP portal method portal get entry list() fails to sufficiently neutralize the where and order by variables before incorporating them into SQL query construction. This allows a low-privileged portal API user to execute blind SQL injection, which can be used to disclose sensitive records and database metadata, alter query behavior, or consume system resources.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later. As a temporary mitigation, restrict access to the portal get entry list() method.