CVE-2022-50589 is a critical SQL injection flaw (CVSS 9.8) in SuiteCRM. The "uid" parameter of the export feature is not handled safely, and an unauthenticated remote attacker can ultimately run code. SuiteCRM versions before 7.12.6 are affected. Upgrade to 7.12.6 or a later release.
What's affected
Per the CVE record, SuiteCRM versions prior to 7.12.6 are affected. SuiteCRM's own release notes list 7.12.6 as the release that carries the fix, and the vendor publishes later 7.12.x releases after it (its release page lists versions up to 7.12.14 at the time of writing).
The record describes the issue as unauthenticated, which means an attacker does not need a login. If your SuiteCRM instance is reachable from the internet, treat it as exposed until you have confirmed the version.
How to check if you're exposed
Find the installed version first. The version is shown in the SuiteCRM admin area, and in a standard install it is also defined in the file suitecrm_version.php in the web root:
grep -i version /var/www/html/suitecrm_version.php
Adjust the path to match your install. If the number is below 7.12.6, you are in the affected range.
Then look at how the instance is exposed. A CRM that sits behind a VPN or an allow list is a smaller target than one on the open internet. Your web server and reverse proxy logs can also show requests to the export action, which is useful context when you review past traffic. If you manage many web applications, a DAST scan can tell you which ones are reachable and what they run.
What to do now
- Confirm the SuiteCRM version in use on every environment, including staging copies that hold real data.
- Upgrade to 7.12.6 at minimum. Because later 7.12.x releases exist, plan the move to the newest release your customisations allow and read the vendor notes first.
- Back up the database and files before the upgrade, and test custom modules against the new version.
- Restrict access to the CRM to the networks that need it while you patch.
- Review web server logs for unusual export requests and database errors from before the upgrade, and rotate credentials if you see signs of abuse.
Why it matters
The weakness is classic SQL injection, tracked as CWE-89. A value supplied by the user, here the "uid" parameter of the export function, ends up inside a database query without being neutralised. Anything that controls part of a query can change what the query does. The record says successful exploitation can ultimately lead to arbitrary code execution, which turns a data bug into full control of the host.
A CRM holds customer contact details, deal history and often credentials for connected services, so a compromise reaches well beyond the server itself. The issue was disclosed to the vendor in March 2022 and published by the researchers in June 2022, according to the Exodus Intelligence advisory, which is a reminder that the CVE entry can appear years after the fix. This CVE is not on the CISA Known Exploited Vulnerabilities list.
A note on old fixes with new CVE numbers
This CVE was assigned in November 2025 for a flaw the vendor fixed in 7.12.6. Scanners and inventories that only look at recent CVEs can miss it. If an old SuiteCRM install is still running in your estate, search by product and version rather than by date. The Gold directory lists the CVE entry, and the dependency scan can tell you whether other known issues apply to the libraries you ship.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to log in to be attacked?
No. The record describes the attacker as remote and unauthenticated, so network exposure matters more than account security here.
Which version fixes it?
SuiteCRM 7.12.6 contains the fix according to the vendor release notes. Later releases are also available, so upgrade to the newest one you can.
Sources
- Exodus Intelligence advisory for the SuiteCRM export SQL injection
- SuiteCRM 7.12.x release notes
- VulnCheck advisory
Last reviewed: 19 October 2026.
