SuiteCRM Authenticated Blind SQL Injection Vulnerability in GraphQL API
Vulnerability
A blind, time-based SQL injection vulnerability has been identified in the SuiteCRM GraphQL API, specifically within the appMetadata operation. This issue affects versions 8.6.0 through 8.9.0 and allows authenticated users to extract arbitrary data from the database without requiring administrative access.
Impact
Exploitation of this vulnerability could lead to unauthorized data extraction from the application's database.
Remediation
Users can upgrade to SuiteCRM version 8.9.1 to address this vulnerability.
Added: Nov 8, 2025, 2:20 AM
Updated: Nov 8, 2025, 2:20 AM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
2.5exploitability
6.6remediation
7.7relevance
1.0threat
6.4urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.