CVE-2026-29106
SuiteCRM has blind XSS in return_id parameter
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
8th
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the value of the return_id request parameter is copied into the value of an HTML tag attribute which is an event handler and is encapsulated in double quotation marks. Versions 7.15.1 and 8.9.3 patch the issue. Users should also use a Content Security Policy (CSP) header to completely mitigate XSS.
| CWE | CWE-79 CWE-80 CWE-116 CWE-159 |
| Vendor | suitecrm |
| Product | suitecrm |
| Published | Mar 19, 2026 |
| Last Updated | Mar 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for suitecrm suitecrm
Be the first to know when new medium vulnerabilities affecting suitecrm suitecrm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
SuiteCRM / SuiteCRM
< 7.15.1 >= 8.0.0, < 8.9.3