CVE-2026-71548

Summary

In SuiteCRM versions prior to 7.15.2 and 8.10.2, the AOR_Report::build_report_query_where method improperly incorporates user-controlled input from report editor parameters without sufficient validation, enabling authenticated users with report-editing privileges to inject malicious SQL and extract sensitive data—including user hashes, OAuth2 tokens, CRM records, reports, and configuration—from the database.

Exploitability

Exploitation requires authentication and report-editing permissions, but no user interaction or complex conditions; it is straightforward for an insider threat or compromised low-privilege account.

Blast radius

Successful exploitation allows full read access to the entire SuiteCRM database, potentially exposing credentials, tokens, customer data, internal reports, and system configuration, enabling credential reuse, session hijacking, and further lateral movement.

Detection

Monitor database logs for SQL queries containing unexpected field references in WHERE clauses (e.g., unquoted column names or malformed expressions) alongside report generation events; also watch for anomalous SELECT patterns targeting sensitive tables like users, oauth2_tokens, or config from non-admin accounts.

Prioritized remediation

Upgrade to SuiteCRM version 7.15.2 or 8.10.2 immediately; if upgrading is delayed, restrict report-editing permissions to trusted users only and audit all custom report queries for unsafe parameter usage.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.