SuiteCRM version 7.10.7 contains a SQL injection flaw where the parentTab parameter can be manipulated by authenticated users. By sending crafted GET requests to the email module, attackers can inject Boolean-based SQL fragments and retrieve sensitive database content. The primary impact is unauthorized disclosure of data and potential compromise of database integrity.

The vulnerability affects installations running SuiteCRM 7.10.7. Any deployment of this product that exposes the email module and allows authenticated access to the parentTab parameter is susceptible.

The CVSS score of 7.1 indicates high severity, but exploit probability data (EPSS) is unavailable and the vulnerability is not listed in the KEV catalog, suggesting limited public exploitation to date. The attack requires authentication and is performed via a web-based GET request, making it accessible to attackers who can reach the email module endpoint.