CVE-2026-69134

Summary

SuiteCRM's REST v4 JSON handler allows authenticated users to inject SQL via relationship fields (CWE-89) because user-controlled data from $GLOBALS['RAW_REQUEST'] is interpolated into SQL queries without sanitization, enabling unauthorized database access or modification.

Exploitability

Requires valid authentication and knowledge of the vulnerable relationship endpoints, but exploitation is straightforward once authenticated due to lack of input validation.

Blast radius

An attacker could read or modify sensitive CRM data, potentially escalating to file writes if the database account has elevated privileges, compromising confidentiality, integrity, and availability.

Detection

Log entries showing SQL errors or unusual query patterns in REST v4 endpoints, especially those involving relationship field updates with syntactically invalid or suspicious input; monitor for anomalous database queries containing unescaped single quotes or UNION-based syntax from authenticated users.

Prioritized remediation

Upgrade to SuiteCRM version 7.15.2 or 8.10.2, where the vulnerability is fixed.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.