CVE-2026-33289

Received Received - Intake

LDAP Injection in SuiteCRM Authentication Enables Bypass, Disclosure

Publication date: 2026-03-20

Last updated on: 2026-03-23

Assigner: GitHub, Inc.

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection vulnerability exists in the SuiteCRM authentication flow. The application fails to properly sanitize user-supplied input before embedding it into the LDAP search filter. By injecting LDAP control characters, an unauthenticated attacker can manipulate the query logic, which can lead to authentication bypass or information disclosure. Versions 7.15.1 and 8.9.3 patch the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-20

Last Modified

2026-03-23

Generated

2026-07-06

AI Q&A

2026-03-20

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33289

Affected Vendors & Products

Vendor	Product	Version / Range
suitecrm	suitecrm	to 7.15.1 (exc)
suitecrm	suitecrm	From 8.0.0 (inc) to 8.9.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-90	The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-33289 is an LDAP Injection vulnerability found in the authentication module of SuiteCRM versions prior to 7.15.1 and 8.9.3. The issue occurs because the application does not properly sanitize user-supplied input before embedding it into LDAP search filters.

This improper handling allows an unauthenticated attacker to inject LDAP control characters and manipulate the LDAP query logic.

As a result, the attacker can bypass authentication or gain unauthorized access to sensitive information.

Impact Analysis

This vulnerability can have severe impacts including authentication bypass, which allows attackers to gain unauthorized access to the SuiteCRM system without valid credentials.

Additionally, it can lead to unauthorized information disclosure, compromising the confidentiality of sensitive data stored within the CRM.

The vulnerability has a high impact on confidentiality, integrity, and availability, making it a critical security risk.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate the LDAP Injection vulnerability in SuiteCRM, you should immediately upgrade your SuiteCRM installation to version 7.15.1 or later, where the issue has been patched.

This update ensures proper sanitization of user-supplied input in the LDAP authentication flow, preventing attackers from manipulating LDAP queries.

Hi! I’m here to help you understand CVE-2026-33289. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70