Skip to content
OpenAdvisories

Product · Suite CRM

SuiteCRM-Core

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-32697

    SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the `RecordHandler::getRecord()` method retrieves any record by module and ID without checking the current user's ACL view permi…

    Suite CRM SuiteCRM-Core
  • Medium 6.5
    CVE-2026-29108

    Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, an authenticated API endpoint allows any user to retrieve detailed information about any other user, including their password ha…

    Suite CRM SuiteCRM-Core
  • Medium 6.5
    CVE-2025-64493

    SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind (time-based) SQL-injection inside the appMetadata-operation of the GraphQL-API. This al…

    Suite CRM SuiteCRM-Core
  • Medium 5.3
    CVE-2025-54786

    SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated acto…

    Suite CRM SuiteCRM-Core