CVE-2026-29099Disclosure(suitecrm / suitecrm)

LOWCVSS 8.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch suitecrm suitecrm systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()` function in `include/OutboundEmail/OutboundEmail.php` fails to properly neutralize the user controlled `$id` parameter. It is assumed that the function calling `retrieve()` will appropriately quote and sanitize the user input. However, two locations have been identified that can be reached through the `EmailUIAjax` action on the `Email()` module where this is not the case. As such, it is possible for an authenticated user to perform SQL injection through the `retrieve()` function. This affects the latest major versions 7.15 and 8.9. As there do not appear to be restrictions on which tables can be called, it would be possible for an attacker to retrieve arbitrary information from the database, including user information and password hashes. Versions 7.15.1 and 8.9.3 patch the issue.

suitecrm CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-38rf-h37x-7767

Other references

https://docs.suitecrm.com/admin/releases/7.15.x

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

suitecrm

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-03-19); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

suitecrm

Products

suitecrm

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Disclosure

250.0%

Patch

125.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-19	2	Disclosure1Patch1
2026-03-20	2	Disclosure1General1

Full discourse4 posts

Infoflowcloud@infoflowcloud202d
General
🚨*CVE* CVE-2026-29099 SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()` functio… https://www.cve.org/CVERecord?id=CVE-2026-29099 ----- Traducción: CVE-2026-29099 Sui… http://infoflow.cloud`
Post summary
The post highlights a newly disclosed CVE in SuiteCRM, noting the affected function and version, but does not provide exploit details, patch info, or evidence of active attacks.
0000033
61 followersView on X
CVE@CVEnew202d
Disclosure
CVE-2026-29099 SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()` functio… https://www.cve.org/CVERecord?id=CVE-2026-29099
Post summary
CVE-2026-29099 is a disclosed vulnerability in SuiteCRM’s retrieve() function affecting versions before 7.15.1 and 8.9.3; no PoC, exploit, patch, or active exploitation details are provided.
00000149
56.8K followersView on X
The Hacker Wire@TheHackerWire203d
Disclosure
🟠 CVE-2026-29099 - High SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()` function in `include/OutboundEma... https://www.thehackerwire.com/vulnerability/CVE-2026-29099/ https://t.co/Bsu4NFBr8Z
Post summary
The post announces CVE-2026-29099 as a high‑severity flaw in SuiteCRM’s retrieve function, with no PoC, exploit code, or patch information provided.
0000044
137 followersView on X
CVEFind.com@CveFindCom203d
Patch
[CVE-2026-29099: HIGH] SuiteCRM versions 7.15.1 and 8.9.3 fix a SQL injection vulnerability in the `retrieve()` function of `OutboundEmail.php`. Update now for improved cyber security.#cve,CVE-2026-29099,#cybersecurity https://cvefind.com/CVE-2026-29099
Post summary
The post announces a high‑severity SQL injection flaw in SuiteCRM’s retrieve() function that has been patched in versions 7.15.1 and 8.9.3, urging users to update.
0000039
603 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	suitecrm	suitecrm	-	-	-

Explore more

Back to dashboard suitecrm CVEs suitecrm vulnerabilities

What researchers are saying

CVE-2026-29099

Infoflowcloud@infoflowcloudGeneral

The post highlights a newly disclosed CVE in SuiteCRM, noting the affected function and version, but does not provide exploit details, patch info, or evidence of active attacks.

CVE@CVEnewDisclosure

CVE-2026-29099 is a disclosed vulnerability in SuiteCRM’s retrieve() function affecting versions before 7.15.1 and 8.9.3; no PoC, exploit, patch, or active exploitation details are provided.

The Hacker Wire@TheHackerWireDisclosure

The post announces CVE-2026-29099 as a high‑severity flaw in SuiteCRM’s retrieve function, with no PoC, exploit code, or patch information provided.

CVEFind.com@CveFindComPatch

The post announces a high‑severity SQL injection flaw in SuiteCRM’s retrieve() function that has been patched in versions 7.15.1 and 8.9.3, urging users to update.