CVE-2026-29099 - Vulnerability Analysis

Overview

SuiteCRM < 7.15.1 and < 8.9.3 contain a SQL injection caused by improper sanitization of the user-controlled $id parameter in include/OutboundEmail/OutboundEmail.php retrieve() function, letting authenticated users retrieve arbitrary database information, exploit requires authentication.

Severity & Score

Impact

Authenticated attackers can retrieve arbitrary database information, including sensitive user data and password hashes.

Mitigation

Upgrade to versions 7.15.1 and 8.9.3 or later.

References

• https://docs.suitecrm.com/admin/releases/7.15.x
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-38rf-h37x-7767

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner