CVE-2026-33289

The record

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection vulnerability exists in the SuiteCRM authentication flow. The application fails to properly sanitize user-supplied input before embedding it into the LDAP search filter. By injecting LDAP control characters, an unauthenticated attacker can manipulate the query logic, which can lead to authentication bypass or information disclosure. Versions 7.15.1 and 8.9.3 patch the issue.

Affected packages

Related vulnerabilities

• CVE-2026-15723 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before… CWE-90
• CVE-2026-80055 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-90
• CVE-2026-75020 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')… CWE-90
• CVE-2026-19271 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')… CWE-90
• CVE-2026-76373 In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with… CWE-90
• CVE-2026-19930 A security flaw has been discovered in Dolibarr up to 23.0.3. CWE-90
• CVE-2026-74241 A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP)… CWE-90
• CVE-2026-16071 A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user… CWE-90