# CVE-2026-61653: SuiteCRM Campaigns SQL injection in PopupCampaignRoi

Source: https://junglewise.ai/threats/cve-2026-61653-suitecrm-is-an-open-source-enterprise-ready-customer-relationship  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-61653 · Severity: high · CVSS 8.3 · Published 2026-11-05

SuiteCRM is an open-source CRM system used by enterprises to manage customer relationships and sales data. An authenticated attacker with Campaigns access can exploit a SQL injection vulnerability to extract or manipulate sensitive data from the database through time-based blind SQL injection attacks. This could lead to unauthorized access to customer information, financial data, or other confidential business information stored in the CRM.

Technologies: [SuiteCRM](https://junglewise.ai/threats/technologies/suitecrm-suitecrm). Vendors: [SuiteCRM](https://junglewise.ai/threats/vendors/suitecrm).

## Quick answers

**Is CVE-2026-61653 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61653 being exploited in the wild.

**How severe is CVE-2026-61653?** High severity, with a CVSS score of 8.3, published 5 November 2026.

**Which products and versions are affected?** SuiteCRM prior to 7.15.2 and 8.10.2.

**Is there a fix for CVE-2026-61653?** Yes: fixed in SuiteCRM 7.15.2, 8.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61653 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-61653?** Check whether you run SuiteCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SuiteCRM 7.15.2, 8.10.2

## Technical details

The vulnerability exists in modules/Campaigns/PopupCampaignRoi.php where user input from $_REQUEST['id'] is interpolated directly into SQL queries. Although the securexss() function normally entity-encodes quotes, an XSS payload prefix causes AntiXSS to select a processed string that allows literal quotes to bypass encoding and reach the SQL query. An authenticated user with Campaigns module access can perform time-based blind SQL injection against arbitrary database tables.

## Affected products

- SuiteCRM SuiteCRM prior to 7.15.2 and 8.10.2

## Timeline

- 2026-11-05: disclosed

## References

- [https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68](https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68)
- [https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2](https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2)

## Related threats

- [SuiteCRM SQL injection in SOAP portal API](https://junglewise.ai/threats/cve-2026-97377-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM path traversal in workflow controller](https://junglewise.ai/threats/cve-2026-71550-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM SQL injection in report query builder](https://junglewise.ai/threats/cve-2026-71548-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM SQL injection in AOR report generation](https://junglewise.ai/threats/cve-2026-69145-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM download authorization bypass in document access](https://junglewise.ai/threats/cve-2026-69144-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)