CVE-2026-29097 HIGH

CVE-2026-29097: SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet

Vendor Suitecrm
Product SuiteCRM
Weakness CWE-918 · SSRF
Published March 19, 2026
Last update March 21, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N

What the vulnerability does

01Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions prior to 7.15.1 and 8.9.3 contain a Server-Side Request Forgery (SSRF) vulnerability combined with a Denial of Service (DoS) condition in the RSS Feed Dashlet component. Versions 7.15.1 and 8.9.3 patch the issue.

Key dates

02Disclosure timeline

March 19, 2026 CVE published
March 21, 2026 Record updated