# CVE-2026-69141: SuiteCRM Cases controller SQL injection via unfiltered POST parameter

Source: https://junglewise.ai/threats/cve-2026-69141-suitecrm-is-an-open-source-enterprise-ready-customer-relationship  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-69141 · Severity: high · CVSS 8.3 · Published 2026-11-05

SuiteCRM is an open-source CRM system used to manage customer relationships and business interactions. A low-privileged user with access to the Cases module can inject SQL commands through a search field to extract sensitive database information, potentially exposing customer data, sales records, and other confidential business information.

Technologies: [SuiteCRM](https://junglewise.ai/threats/technologies/suitecrm-suitecrm). Vendors: [SuiteCRM](https://junglewise.ai/threats/vendors/suitecrm).

## Quick answers

**Is CVE-2026-69141 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69141 being exploited in the wild.

**How severe is CVE-2026-69141?** High severity, with a CVSS score of 8.3, published 5 November 2026.

**Which products and versions are affected?** SuiteCRM Prior to 7.15.2 and 8.10.2.

**Is there a fix for CVE-2026-69141?** Yes: fixed in SuiteCRM 7.15.2 and 8.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69141 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-69141?** Check whether you run SuiteCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SuiteCRM 7.15.2 and 8.10.2

## Technical details

The CasesController action_get_kb_articles action unsafely interpolates the $_POST['search'] parameter into a CASE WHEN ... LIKE SQL expression without proper sanitization. Although the securexss() function normally entity-encodes quotes, an XSS payload prefix causes AntiXSS to return an unencoded string, allowing literal quotes to reach the SQL query. This enables blind SQL injection to extract database contents; the vulnerability requires Cases module access and is exploitable without elevated privileges.

## Affected products

- SuiteCRM SuiteCRM Prior to 7.15.2 and 8.10.2

## Timeline

- 2026-11-05: disclosed

## References

- [https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68](https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68)
- [https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2](https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2)

## Related threats

- [SuiteCRM SQL injection in SOAP portal API](https://junglewise.ai/threats/cve-2026-97377-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM path traversal in workflow controller](https://junglewise.ai/threats/cve-2026-71550-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM SQL injection in report query builder](https://junglewise.ai/threats/cve-2026-71548-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM SQL injection in AOR report generation](https://junglewise.ai/threats/cve-2026-69145-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM download authorization bypass in document access](https://junglewise.ai/threats/cve-2026-69144-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)