CVE-2026-33289
Received Received - Intake
LDAP Injection in SuiteCRM Authentication Enables Bypass, Disclosure

Publication date: 2026-03-20

Last updated on: 2026-03-23

Assigner: GitHub, Inc.

Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection vulnerability exists in the SuiteCRM authentication flow. The application fails to properly sanitize user-supplied input before embedding it into the LDAP search filter. By injecting LDAP control characters, an unauthenticated attacker can manipulate the query logic, which can lead to authentication bypass or information disclosure. Versions 7.15.1 and 8.9.3 patch the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-20
Last Modified
2026-03-23
Generated
2026-06-16
AI Q&A
2026-03-20
EPSS Evaluated
2026-06-15
NVD
CVE-2026-33289
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
suitecrm suitecrm to 7.15.1 (exc)
suitecrm suitecrm From 8.0.0 (inc) to 8.9.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-90 The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-33289 is an LDAP Injection vulnerability found in the authentication module of SuiteCRM versions prior to 7.15.1 and 8.9.3. The issue occurs because the application does not properly sanitize user-supplied input before embedding it into LDAP search filters.

This improper handling allows an unauthenticated attacker to inject LDAP control characters and manipulate the LDAP query logic.

As a result, the attacker can bypass authentication or gain unauthorized access to sensitive information.

Impact Analysis

This vulnerability can have severe impacts including authentication bypass, which allows attackers to gain unauthorized access to the SuiteCRM system without valid credentials.

Additionally, it can lead to unauthorized information disclosure, compromising the confidentiality of sensitive data stored within the CRM.

The vulnerability has a high impact on confidentiality, integrity, and availability, making it a critical security risk.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate the LDAP Injection vulnerability in SuiteCRM, you should immediately upgrade your SuiteCRM installation to version 7.15.1 or later, where the issue has been patched.

This update ensures proper sanitization of user-supplied input in the LDAP authentication flow, preventing attackers from manipulating LDAP queries.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart