CVE-2026-33289 is an LDAP injection flaw in the SuiteCRM authentication flow. NVD scores it 8.8 high. User input reaches an LDAP search filter without proper cleaning, which can lead to authentication bypass or information disclosure. Upgrade to SuiteCRM 7.15.1 or 8.9.3.
What's affected
SuiteCRM before 7.15.1 on the 7.x line, and before 8.9.3 on the 8.x line. The GitHub advisory lists 7.15.0 and below as affected and 7.15.1 as patched. The NVD description names 8.9.3 as the fixed 8.x release.
How to check if you're exposed
Find your installed version in the SuiteCRM admin area, then compare it to the fixed releases above. Also check whether you use LDAP authentication. The advisory places the flaw in the authentication flow, so an installation that never uses LDAP login has less to worry about, but the advisory should be your source for that call.
What to do now
- Upgrade to 7.15.1 or 8.9.3, following the SuiteCRM release notes for your line.
- Review authentication logs for unusual login attempts against the LDAP backed login.
- If you cannot upgrade soon, consider limiting who can reach the login page.
- Take a backup before you upgrade, and test LDAP login afterward.
- Rotate any credentials that could have been exposed if you see suspicious activity.
Why it matters
The record gives the privileges required as low, so the attacker needs little more than reach to the login path. The advisory does not say more than that about preconditions.
The weakness class is CWE-90. LDAP injection works like SQL injection. If special characters in user input are placed into a query without neutralizing them, the person typing can change the logic of the query.
On a login path, that can mean a check that should fail passes. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and the advisory does not report exploitation.
Quick check
Is a fix available for SuiteCRM 7 and 8?
Yes. Version 7.15.1 patches the 7.x line and 8.9.3 patches the 8.x line.
Sources
Last reviewed: 19 October 2026.
