What is the CVSS score of CVE-2026-29099?

CVE-2026-29099 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-29099?

SuiteCRM installations (versions 7.15 and 8.9) contain a critical SQL injection vulnerability that allows authenticated users to extract sensitive data from the database, including user credentials…

How to fix or mitigate CVE-2026-29099?

Within 24 hours: Inventory all SuiteCRM deployments and their versions; restrict access to the Email module's EmailUIAjax action to only essential users via role-based access controls. Within 7 days: Implement input validation and WAF rules to block SQL injection patterns targeting the retrieve() function parameters; monitor database logs for suspicious query activity. Within 30 days: Upgrade to SuiteCRM 7.15.1 or 8.9.3 or later as patches become available; conduct security audit of database access logs to detect any prior exploitation.

PHP CVE-2026-29099

HIGH

SQL Injection (CWE-89)

2026-03-19 GitHub_M

PHP SQLi

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 19, 2026 - 23:00 vuln.today

CVE Published

Mar 19, 2026 - 22:46 nvd

HIGH 8.8

DescriptionGitHub Advisory

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the retrieve() function in include/OutboundEmail/OutboundEmail.php fails to properly neutralize the user controlled $id parameter. It is assumed that the function calling retrieve() will appropriately quote and sanitize the user input. However, two locations have been identified that can be reached through the EmailUIAjax action on the Email() module where this is not the case. As such, it is possible for an authenticated user to perform SQL injection through the retrieve() function. This affects the latest major versions 7.15 and 8.9. As there do not appear to be restrictions on which tables can be called, it would be possible for an attacker to retrieve arbitrary information from the database, including user information and password hashes. Versions 7.15.1 and 8.9.3 patch the issue.

AnalysisAI

SQL injection in SuiteCRM versions prior to 7.15.1 and 8.9.3 allows authenticated users to execute arbitrary SQL queries through improper input validation in the EmailUIAjax module's retrieve() function. An attacker with valid credentials can exploit this vulnerability to read, modify, or delete sensitive database records without restrictions. The vulnerability requires authentication but has no patch currently available.

Technical ContextAI

The vulnerability occurs in the retrieve() function within include/OutboundEmail/OutboundEmail.php in SuiteCRM, an open-source customer relationship management application identified by CPE cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:*. The root cause is a classic SQL injection vulnerability (CWE-89) where user-controlled input from the $id parameter is not properly sanitized before being used in SQL queries. Specifically, two code paths through the EmailUIAjax action in the Email() module fail to quote and sanitize input before passing it to the retrieve() function, which trusts its callers to provide safe input. This architectural assumption creates a dangerous situation where authenticated users can inject arbitrary SQL commands.

RemediationAI

Immediately upgrade SuiteCRM to version 7.15.1 or later for 7.x installations, or version 8.9.3 or later for 8.x installations, as detailed in the vendor security advisory at https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-38rf-h37x-7767. Until patching is possible, consider implementing database query logging and monitoring for suspicious activity, restricting database permissions for the SuiteCRM application user to minimum required privileges, and reviewing user access to ensure only trusted users have authentication credentials. Additional hardening through web application firewall rules to detect SQL injection attempts may provide defense-in-depth but should not be relied upon as the primary mitigation.