SuiteCRM suffers from an LDAP filter injection in the authentication module. The flaw arises because the application does not sanitize user‑supplied input before inserting it into the LDAP search filter, a weakness that maps to CWE‑90. By inserting LDAP control characters an attacker can alter the query logic, enabling them to bypass authentication or extract sensitive directory data. The result is privilege escalation through unauthenticated access or information disclosure to an attacker.

All versions of SuiteCRM prior to 7.15.1 and 8.9.3 are affected. These include the open‑source SuiteCRM product, regardless of deployment platform, as the vulnerability exists in the core authentication flow. Versions 7.15.1 and 8.9.3, and later releases contain the official fix.

The vulnerability received a CVSS score of 8.8, indicating high severity, while the EPSS score is below 1 %, suggesting that public exploitation is unlikely at this time, and it is not listed in the CISA KEV catalog. Because the flaw can be triggered over the normal authentication endpoint, an unauthenticated attacker can reach the vulnerable code without needing any special credentials. If successfully exploited, the attacker gains the ability to bypass login entirely or read directory entries, posing a significant confidentiality and integrity risk to the CRM data.