CVE-2026-33289
Published: 20 March 2026
Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection vulnerability exists in the SuiteCRM authentication flow. The application fails to properly sanitize user-supplied input before embedding it into the…
more
LDAP search filter. By injecting LDAP control characters, an unauthenticated attacker can manipulate the query logic, which can lead to authentication bypass or information disclosure. Versions 7.15.1 and 8.9.3 patch the issue.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of user-supplied input before embedding into LDAP search filters, directly preventing LDAP injection for authentication bypass or disclosure.
Mandates identification, reporting, and correction of flaws like this LDAP injection vulnerability through patching as implemented in SuiteCRM versions 7.15.1 and 8.9.3.
Enables vulnerability scanning to identify LDAP injection flaws in authentication flows during monitoring activities.
Security SummaryAI
CVE-2026-33289 is an LDAP injection vulnerability in the authentication flow of SuiteCRM, an open-source enterprise-ready Customer Relationship Management (CRM) software application. The flaw affects SuiteCRM versions prior to 7.15.1 and 8.9.3, where the application fails to properly sanitize user-supplied input before embedding it into LDAP search filters, allowing injection of LDAP control characters.
An unauthenticated attacker can exploit this vulnerability by manipulating the LDAP query logic during authentication, potentially achieving authentication bypass or information disclosure. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query).
SuiteCRM versions 7.15.1 and 8.9.3 patch this issue. Additional details are available in the release notes at https://docs.suitecrm.com/admin/releases/7.15.x and the GitHub security advisory at https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-26vx-rj47-x599.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LDAP injection in the authentication flow of the public-facing web application SuiteCRM directly enables exploitation of a public-facing application (T1190) for authentication bypass and information disclosure.