CVE-2026-63214

Summary

In SuiteCRM versions prior to 7.15.2 and 8.10.2, legacy REST API endpoints allow authenticated users with list permissions to inject unvalidated SQL WHERE clauses via query parameters, bypassing user-specific filtering and enabling unauthorized access to sensitive data including password hashes.

Exploitability

Exploitation requires a valid authenticated account with list permissions on any module; no elevated privileges or external access are needed beyond standard login credentials.

Blast radius

Successful exploitation allows full database read access, including administrative credentials, enabling complete application compromise and potential lateral movement within the organization.

Detection

Monitor for anomalous SQL query patterns in application logs where the user_hash filter is bypassed—specifically, requests to /service/v4_1/rest.php with get_entry_list, get_entries_count, or query operations returning data outside the caller's expected scope, especially involving sensitive fields like password hashes.

Prioritized remediation

Upgrade to SuiteCRM version 7.15.2 or 8.10.2 immediately; until then, disable legacy REST endpoints (e.g., /service/v4_1/rest.php) for non-essential users and restrict access via network controls.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.