CVE-2026-29105 MEDIUM

CVE-2026-29105: SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture

Vendor Suitecrm
Product SuiteCRM
Weakness CWE-601 · Open redirect
Published March 19, 2026
Last update March 20, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains an unauthenticated open redirect vulnerability in the WebToLead capture functionality. A user-supplied POST parameter is used as a redirect destination without validation, allowing attackers to redirect victims to arbitrary external websites. This vulnerability allows attackers to abuse the trusted SuiteCRM domain for phishing and social engineering attacks by redirecting users to malicious external websites. Versions 7.15.1 and 8.9.3 patch the issue.

Key dates

02Disclosure timeline

March 19, 2026 CVE published
March 20, 2026 Record updated