What is the CVSS score of CVE-2026-33288?

CVE-2026-33288 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Suitecrm are affected by CVE-2026-33288?

SuiteCRM deployments with directory authentication enabled are vulnerable to SQL injection attacks that allow low-privileged users to escalate to administrator access.

How to fix or mitigate CVE-2026-33288?

Within 24 hours: inventory all SuiteCRM instances and confirm which have directory support enabled; disable directory authentication if operationally feasible and document the decision. Within 7 days: implement WAF rules to block SQL injection patterns in authentication requests and restrict network access to SuiteCRM to trusted IP ranges only. Within 30 days: plan and execute upgrade to patched versions (7.15.1 or 8.9.3 or later) or migrate to an alternative CRM solution; establish a change control process for the upgrade.

Suitecrm CVE-2026-33288

HIGH

SQL Injection (CWE-89)

2026-03-20 security-advisories@github.com

Privilege Escalation SQLi Suitecrm

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 00:30 vuln.today

CVE Published

Mar 20, 2026 - 00:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a SQL Injection vulnerability exists in the SuiteCRM authentication mechanisms when directory support is enabled. The application fails to properly sanitize the user-supplied username before using it in a local database query. An attacker with valid, low-privilege directory credentials can exploit this to execute arbitrary SQL commands, leading to complete privilege escalation (e.g., logging in as the CRM Administrator). Versions 7.15.1 and 8.9.3 patch the issue.

AnalysisAI

SQL injection in SuiteCRM's authentication layer when directory support is enabled allows authenticated attackers with low-privilege directory credentials to execute arbitrary SQL commands and escalate privileges to administrator level. The vulnerability stems from insufficient input sanitization of usernames in local database queries. SuiteCRM versions prior to 7.15.1 and 8.9.3 are affected, with no patch currently available.

Technical ContextAI

This vulnerability affects SuiteCRM, an open-source enterprise CRM application built on PHP and MySQL/MariaDB databases. The root cause is CWE-89 (SQL Injection), occurring specifically in the authentication module when LDAP or Active Directory integration is enabled. The application fails to properly sanitize username input received during authentication before incorporating it into SQL queries against the local database. This allows injection of malicious SQL syntax through the username parameter, bypassing standard parameterized query protections. The vulnerability exists in the directory authentication flow where username data from external directory services is validated against local CRM user records without adequate input validation.

RemediationAI

Upgrade to SuiteCRM version 7.15.1 or later for the 7.x branch, or version 8.9.3 or later for the 8.x branch, as documented in the official release notes at https://docs.suitecrm.com/admin/releases/7.15.x and security advisory at https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-7g39-m4fg-vrq7. Until patching is completed, organizations should consider temporarily disabling directory authentication support if not essential for operations, implement strict network access controls limiting CRM access to trusted IP ranges, and monitor authentication logs for suspicious username patterns containing SQL syntax. Review existing user accounts and privileges to identify any unauthorized privilege escalations that may have already occurred.