./bin/console suitecrm:version
Released 31st July 2026
This release removes SOAP Portal support. If you are using SOAP Portal, please migrate to REST API or other supported methods.
A new configuration option disable_v4_api_query_where has been added. This option allows administrators to disable the v4 API query where clause for improved performance. By default, this option is set to true, meaning the v4 API query where clause is disabled. To enable it, set the option to false in the config_override.php.
CVE: CVE-2026-71549: Improper Access Control | GitHub Advisory | Reporter: prakhar0x01
CVE: CVE-Pending: Improper Access Control | GitHub Advisory | Reporter: MichaelPasternak1337
CVE: CVE-2026-61648: SQL Injection | GitHub Advisory | Reporter: Nguy Minh Tuan (@minhtuanact) of Sun* Cyber Security Research Team
CVE: CVE-2026-61649: SSRF Vulnerability | GitHub Advisory | Reporter: morimori-dev
CVE: CVE-2026-61650: Improper Access Control | GitHub Advisory | Reporter: larlarua
CVE: CVE-2026-61651: SQL Injection | GitHub Advisory | Reporter: Security Researcher Ahmed Mosaa
CVE: CVE-2026-61653: SQL Injection | GitHub Advisory | Reporter: Nguy Minh Tuan (@minhtuanact) of Sun* Cyber Security Research Team
CVE: CVE-Pending: SQL Injection | GitHub Advisory | Reporter: marginaldeer
CVE: CVE-2026-69134: SQL Injection | GitHub Advisory | Reporter: Tristan Madani (@TristanInSec) from Talence Security
CVE: CVE-2026-69135: SQL Injection | GitHub Advisory | Reporter: Security Researcher Ahmed Mosaa
CVE: CVE-2026-69136: SQL Injection | GitHub Advisory | Reporter: Security Researcher Ahmed Mosaa
CVE: CVE-2026-69137: SSRF Vulnerability | GitHub Advisory | Reporter: Max Gabriel (EntroVyx)
CVE: CVE-2026-69140: SQL Injection | GitHub Advisory | Reporter: Nguy Minh Tuan (@minhtuanact) of Sun* Cyber Security Research Team
CVE: CVE-2026-69141: SQL Injection | GitHub Advisory | Reporter: Nguy Minh Tuan (@minhtuanact) of Sun* Cyber Security Research Team
CVE: CVE-2026-69142: SQL Injection | GitHub Advisory | Reporter: AdrianJunge
CVE: CVE-2026-69143: SQL Injection | GitHub Advisory | Reporter: Security Researcher Ahmed Mosaa
CVE: CVE-2026-69144: Improper Access Control | GitHub Advisory | Reporter: Yash Shendge (GitHub: ashrexon)
CVE: CVE-2026-63111: Improper Access Control | GitHub Advisory | Reporter: Pedro J. Núñez-Cacho Fuentes (tunelko / blogs.tunelko.com)
CVE: CVE-2026-63213: Path Traversal | GitHub Advisory | Reporter: Khương Anh (@leduckhuong)
CVE: CVE-2026-63214: SQL Injection | GitHub Advisory | Reporter: radoi-teodor
CVE: CVE-2026-63215: SQL Injection | GitHub Advisory | Reporter: Furkan KARAARSLAN https://www.linkedin.com/in/furkan-k/
CVE: CVE-2026-63217: IDOR Vulnerability | GitHub Advisory | Reporter: geo-chen
CVE: CVE-2026-63218: Improper Access Control | GitHub Advisory | Reporter: Yash Shendge (GitHub: ashrexon)
CVE: CVE-Pending: SQL Injection | GitHub Advisory | Reporter: Anonymous
CVE: CVE-2026-71550: LFI to RCE Vulnerability | GitHub Advisory | Reporter: amwhoi
CVE: CVE-2026-71548: SQL Injection | GitHub Advisory | Reporter: Ahmed Alshammari (isch1zo)
CVE: CVE-Pending: SQL Injection | GitHub Advisory | Reporter: AdrianJunge
CVE: CVE-Pending: RCE Vulnerability | GitHub Advisory | Reporter: MichaelPasternak1337
CVE: CVE-Pending: SQL Injection | GitHub Advisory | Reporter: Security Researcher Ahmed Mosaa
CVE: CVE-Pending: Improper Access Control | GitHub Advisory | Reporter: voraci0us
CVE: CVE-Pending: Improper Access Control | GitHub Advisory | Reporter: usmonkhudoyorov
CVE: CVE-Pending: Improper Access Control | GitHub Advisory | Reporter: adilkhan7546
CVE: CVE-Pending: Improper Access Control | GitHub Advisory | Reporter: MichaelPasternak1337
CVE: CVE-Pending: Improper Access Control | GitHub Advisory | Reporter: TA-MU-TA
PR #936 - Update Legacy Migration Description to 7.15.x
PR #943 - Fix #910: Filters are forgotten when leaving module
PR #944 - Fix Email Signature not loading when opening a compose modal
PR #945 - Fix saving a field with metadata in module builder shows the field as custom
PR #904 - Fix #832: Boolean/checkbox filter returns inverted or no results
PR #948 - Update dependencies
PR #954 - Fix #930: variable injector not retrieving module language
PR #955 - Fix #933: Fix Notes file and filename fields both using LBL_FILENAME as vname
Update Classic View rendering to cope with the deprecation of the unload browser event.
Fix Print as PDF bulk action
PR #9773 - Fix #9772: Importing text emails with attachments
PR #10807 - Fix #10804: CalendarSync sync-back preserves external fields
PR #10478 - Fix #10477: Do not exclude email sends from the message queue without filtering by campaign
PR #10822 - Fix #8289: Fix Import data for floating point fields wrongly saved
PR #10501 - Fix #10499: Error when importing in the Locations module
PR #10831 - Fix #10830: Primary email doesn’t update when importing
PR #10838 - Fix #10594: Bad relationship definitions filling the suitecrm logs
PR #10826 - Fix #10825: Truncated value when saving large values in workflow and report conditions
PR #10875 - Fix #10874: 'Associated user' field in OAuth Clients and Tokens lists does not link correctly
PR #10869 - Fix #10763: SMTP credentials wrong after changing a field in outbound email settings
PR #10860 - Fix #10859: Auth window loses connection to the opener when requesting an OAuth token
Fix #3855 - Update PDF Template Samples
Fix #7687 - update sample pdf loader to ignore invalid files
Fix issue in Email automatic import scheduler where Emails from certain timezones were not importing correctly.
Mostly affected Emails where the difference in timezone made the original Email fall on a different day
We have added support for pre-upgrade migrations. This allows to have migrations (for example, to update data or configuration) run before the upgrade process begins.
Backend Record Validators — A new extension point that allows developers to add custom validation logic before record save operations. Validators can block saves by throwing exceptions, enabling enforcement of business rules and access restrictions at the API level. See: Backend Record Validators
Record-Level Async Validators — A new metadata-driven system for running server-side validation when a record is saved. Async validators can display confirmation modals, list modals, or block the save entirely based on backend logic. See: Record-Level Async Validators
Confirmation List Modal — A new modal type that displays a searchable, paginated table of records inside a dialog. Used when a backend process needs to show the user a list of related records and let them decide whether to proceed or cancel. See: Confirmation List Modal
Record Logic — New record-level logic rules in view metadata. Record Logic can update multiple fields at once based on cross-field conditions, autofill fields from related records, or trigger backend calculations. See: Adding Custom Record Logic
Customizing View Metadata — A new guide covering the full metadata extension pipeline, including all four mapper types (Vardef Config Mappers, Field Definition Mappers, View Config Mappers, and View Definition Mappers), with a pipeline diagram, comparison table, and examples for each approach. See: Customizing View Metadata
Confirmation Modals — New documentation covering both the standard Confirmation Modal and the Confirmation List Modal. See: Confirmation Modals
YAML Language Labels — Extensions can now define language labels using YAML files, as an alternative to PHP language files. Supports application strings, list strings, and module strings. See: Adding Language Labels via YAML
SuiteCRM is built with and for its community — thank you to everyone who reported issues, submitted feedback, and contributed code to this release.
Special thanks to the following contributors for their contributions to this release:
Special thanks to everyone who reported the security issues addressed in this release!
Nagarajan Selvaraj Paulmony
Visit Releases for the appropriate upgrade package for your installation.
Found a Bug? Submit an Issue
Want to contribute? Open a Pull Request
Translations: Join us on Crowdin
To report a security issue, please follow our Security Policy.
Released 13th May 2026
This maintenance release resolves three regressions introduced in 8.10. It contains no new features. We recommend all SuiteCRM 8.10 users upgrade promptly.
When editing a standard core field through Studio (for example, marking a field as required or updating a label), SuiteCRM 8.10 was incorrectly injecting a source: custom_fields definition into the generated override file. This caused the system to look for the field in the wrong database table, resulting in SQL errors on save, data appearing blank or missing, and failures in logic hooks or integrations that depend on those fields.
8.10.1 corrects the override generation logic. Studio will now produce clean override files that correctly preserve the status of core fields.
Are you affected? You are affected if you upgraded to 8.10 and used Studio to edit any standard core field afterwards — for example, changing a label, marking a field as required, or adjusting display properties.
If you cannot update right away, or you have already made Studio edits to core fields, you can resolve this manually:
Locate the affected file at: public/legacy/custom/Extension/modules/<Module>/Ext/Vardefs/override_sugarfield<field>.php
Open the file and delete the line that sets source to custom_fields
Go to Administration → Repair and run a Quick Repair and Rebuild
If SQL scripts appear at the bottom of the Repair page, run them to resync the metadata
We recommend avoiding further core field edits via Studio on production environments until you have applied the 8.10.1 update.
After upgrading to 8.10, currency variables in PDF templates stopped resolving to their actual values. Instead of displaying the expected currency symbol, documents were showing the raw variable names. This has been fixed and PDFs will once again display currency symbols as expected.
Before 8.10, generated PDFs for Invoices, Quotes and Contracts were named after the source record (e.g. Invoice_InvoiceName.pdf). With the 8.10 upgrade, filenames changed to reflect the PDF template name instead (e.g. PDF_TemplateName.pdf). 8.10.1 restores the original behaviour, where Invoices, Quotes and Contracts PDF will be named after the source record (e.g. Invoice_InvoiceName.pdf).
SuiteCRM is built with and for its community — thank you to everyone who reported issues, submitted feedback, and contributed code to this release.
Special thanks to the following contributors for their contributions to this release:
Visit Releases for the appropriate upgrade package for your installation.
Found a Bug? Submit an Issue
Want to contribute? Open a Pull Request
Translations: Join us on Crowdin
To report a security issue, please follow our Security Policy.
Released: 30th April 2026
SuiteCRM 8.10 is one of our most significant releases to date. It brings the Documents and Notes modules fully into the SuiteCRM 8 UI, introduces the long-awaited Image Field, lays the groundwork for large-scale async background processing, and delivers a substantially improved email compose experience. This release also merges SuiteCRM 7.15, bringing PHP 8.4 support and advanced calendar sync.
You can now upload and display images directly within any module — making it ideal for product photos, profile pictures, logos, and other visual assets. Image fields can be added via Studio in the Admin panel, just like any other field type, with configuration options for storage type, display dimensions, and preview behaviour.
In List Views and Subpanels, SuiteCRM automatically generates thumbnails and lazy loads images to keep performance in check at scale. Both the thumbnail dimensions and the lazy loading behaviour are configurable via config_override.php.

Documentation: Image Field
Writing emails in SuiteCRM previously meant working within a constrained modal with limited formatting space and no way to attach documents without leaving the compose window. SuiteCRM 8.10 addresses all of this:
Maximise — The compose modal can now be expanded to full screen, giving you the space you need for longer messages.
Attachments — Documents can be attached directly from within the compose window, without switching context.
Variable Injector — Dynamic content (such as recipient name or account details) can be inserted inline using the new Variable Injector button.
Draft Management — Full draft support is now included. Drafts are saved automatically and can be managed, resumed, or discarded from a dedicated Drafts area.
Documentation: Composing an Email · Managing Drafts
Campaigns that hit SMTP errors or exceeded error thresholds previously continued sending silently, making it difficult to detect and respond to broken outbound configurations. SuiteCRM 8.10 introduces automatic pause-and-resume behaviour:
Paused Status — An Email Marketing Record is automatically paused when the error threshold per batch is reached, or when the selected Outbound Email account cannot connect to SMTP. Both queueing and sending stop while paused.
Warning Banner — A banner is displayed on the record showing the most recent error that triggered the pause.
Resume Action — Use the new Resume action to continue from where the campaign left off, without re-sending to already-processed recipients.
Two new configuration options are also available:
| Option | Description |
|---|---|
Maximum send retries per recipient on failure |
How many times SuiteCRM retries a failed send before marking the recipient as permanently failed. |
Error threshold per batch |
Maximum errors allowed in a single batch before the record is auto-paused. Set to |
Documentation: Campaigns
Both the Documents and Notes modules have been fully migrated to the SuiteCRM 8 interface, replacing the legacy views with consistent, modern patterns.
File Field — File attachments now use the new File field type, with malware scanning support if configured.
Storage Type — Documents and Document Revisions both default to private-documents storage. Both fields must use the same storage type — changing only one is not supported.
Document Revisions Widget — A new table widget replaces the previous subpanel. From it you can add new revisions, download files by clicking the filename, and delete revisions using the trash icon. Note that the active revision cannot be deleted until a newer revision exists.
PDF generation has been updated on several key modules to use the SuiteCRM 8 entrypoint and compose modal.
Print as PDF — Available from the action menu within the record view for Accounts, Quotes, Invoices, Contracts, Contacts, and Leads. Select a template, and the PDF is generated and downloaded automatically. A Note record is also created with the PDF attached.
Email PDF — For Quotes, Invoices, and Contracts, an Email PDF option opens a pre-composed email with the PDF already attached and content populated from the record.
Bulk PDF Generation — Select multiple records from the list view, then use Print as PDF from the bulk action menu to generate a single merged PDF. A Note is created for each selected record with its respective PDF attached.
Documentation: PDF Templates
File Fields can now be added to any module directly through Studio, without custom development. If malware scanning is configured on your instance, file uploads through the File field will be scanned automatically.
Documentation: File Field
SuiteCRM 8.10 introduces Async Tasks — a new type of background job designed to process large volumes of data without blocking the application or overloading the server. Tasks are queued and processed by a background worker, and progress is tracked in real time.
Action Required — SuiteCRM 8.10 introduces a new background worker that must be configured for async tasks (including Manual Migration Tasks) to function. Without a running worker, these tasks will remain in Pending status indefinitely.
See the Messenger Setup guide for full instructions on how to configure the worker.
Manual Migration Tasks are a specialised type of Async Task for handling complex data migrations. They run in the background so you can continue using SuiteCRM normally while a migration is in progress.
Navigate to Administration Panel → Admin Tools → Migrations to access them.
Key behaviours:
Tasks are added automatically after an upgrade, but can also be created manually.
Data is processed in small batches to avoid server overload.
Progress is tracked in real time: items processed, succeeded, and failed.
Failed items can be retried individually or the entire task can be re-run.
The following migration tasks are included with the upgrade to 8.10:
Migrate Lead Photos
Migrate Contact Photos
Migrate Prospect Photos
Migrate Document Revision Files
Migrate Notes Attachments
Migrate Legacy Google Calendar Meetings
Migrate Legacy Google Calendar Users
The default transport uses your existing database (Doctrine) and works without any additional infrastructure. If you process high volumes of data, RabbitMQ (AMQP) and Redis are also supported.
Key configuration areas in .env.local:
| Setting | Purpose |
|---|---|
|
Primary transport (default: Doctrine) |
|
Where failed messages are sent |
|
Log verbosity (default: |
|
Optional custom log file |
|
Route specific tasks to specific transports |
Batch sizes are controlled in config_override.php:
max_migration_items_to_queue_per_run (default: 50)
max_migration_items_to_process_per_run (default: 20)
Documentation: Async Tasks · Developer Guide: Async Tasks · Manual Migrations
The media upload directory structure has been updated for consistency. If you have custom code or integrations that reference these paths directly, they will need to be updated.
| Before | After |
|---|---|
|
|
Top-level directory: |
Top-level directory: |
Private media endpoint: |
Private media endpoint: |
On upgrade, existing files are migrated to the new directories automatically.
Upon upgrading to 8.10, existing file attachments for Contacts, Leads, Prospects/Targets, Document Revisions, and Notes stored in the legacy file storage system can be migrated via the Manual Migration Tasks described above.
As a fallback, backwards compatibility support has been added for legacy files — existing file fields using the old storage system are auto-detected and continue to display correctly without any manual intervention.
A new TEMPORARY_FILE_BASE_DIR option has been added to .env to control where temporary files are stored during upload and processing. The default value is tmp.
A new click action system has been added for record thread items, firing on row click rather than requiring a dedicated button.
Base class: RecordThreadItemClickActionHandler — implement run(), shouldDisplay(), and checkRecordAccess()
Config: RecordThreadItemClickActionConfig — accepts key, asyncProcess?, params?, activeOnFields?, modes?, acl?, and default?
RecordThreadConfig now accepts clickActions?: RecordThreadItemClickActionConfig[]
New properties on ButtonInterface:
dynamicEndIcon — reactive end icon
endIconTitleKey, endIconKlass, endIcon — static end icon configuration
dynamicLabelKlass — dynamic label class
hideIfLoading — hides a widget row while the statistic is loading
dynamicLabelTooltip — enables a tooltip on a dynamic label in a widget row
emptyDynamicLabelKey — alternate label key displayed when the field has no value
hideIfEmpty — display logic shorthand
A new linkActions array in a field’s viewdef controls how clicking a field value navigates or triggers an action.
Base class: LinkActionHandler — implement isRouterLink() and getLink()
Manager: LinkActionManager — holds an actions map per mode
Built-in actions:
default — existing navigation behaviour
async-process — fires a backend process on click
record-link — navigates to a record using params.moduleField and params.recordField
emit-event (EmitEventAsyncAction) — reads data.event and emits on AppStateStore.eventEmitterMapper
record-thread-modal (RecordThreadModalAsyncAction) — opens a record-thread-modal popup from a backend process response
modal-create (ModalCreateLineAction, mode: list) — opens a RecordModalComponent to create a related record inline without leaving the list view
Three new action zones, each with its own manager and abstract handler:
| Zone | Purpose |
|---|---|
Header: |
Actions placed in the modal header, next to the title |
Footer: |
Actions placed in the modal footer, next to the buttons |
Record: |
Actions targeting the current record |
Four new operators are available:
| Operator | Behaviour |
|---|---|
is-true |
Compares against |
is-false |
Compares against |
previous-value-equal |
Compares a field against its previous value |
previous-value-not-equal |
Inverse of |
Documentation: Operators
A new console command is available to check the currently installed SuiteCRM version:
./bin/console suitecrm:version
SuiteCRM 7.15 has been merged into the 8.10 release. Key features it brings include:
PHP 8.4 support
Advanced Calendar Integration & Sync
Survey Styling Improvements
Updated Automatic Email Import
V8 API: OAuth Auth Code Grant
For the full list of changes from 7.15, see the 7.15 Release Notes.
SuiteCRM is built with and for its community — thank you to everyone who reported issues, submitted feedback, and contributed code to this release.
Special thanks to the following contributors for their contributions to this release:
Visit Releases for the appropriate upgrade package for your installation.
Found a Bug? Submit an Issue
Want to contribute? Open a Pull Request
Translations: Join us on Crowdin
To report a security issue, please follow our Security Policy.
For professional support and enterprise services, visit SuiteCRM Ltd Support Services.
Content is available under GNU Free Documentation License 1.3 or later unless otherwise noted.