Read the docs
TI-2026-70691 Aliases CVE-2026-108712GHSA-qhw8-6crf-m6jv

Missing authorization in SuiteCRM DetailUserRole exposes user ACL data

Priority MEDIUM 57CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

SuiteCRM through 7.15.2 and 8.10.2 is affected. A missing authorization check in the DetailUserRole entry point lets authenticated non-admin users view other users' ACL data (CWE-862). An attacker supplies another non-admin user's id in the record parameter to read that user's assigned roles and per-module ACL action matrix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles and per-module ACL action matrix.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00349 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SuiteCRMSuiteCRMup to 7.15.2; 8.0.0 – 8.10.2—No fix listedCNA
  • SuiteCRM VendorSuiteCRM Affected up to 7.15.2; 8.0.0 – 8.10.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for SuiteCRM.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-108712
  2. 2026-10-11 Alias added: GHSA-qhw8-6crf-m6jv
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 4

  • TI-2019-15717 SuiteCRM 7.10.7 SQL Injection via record Parameter CVSS 4.0HIGH 7.1
  • TI-2019-15716 SuiteCRM 7.10.7 SQL Injection via parentTab Parameter CVSS 4.0HIGH 7.1
  • TI-2025-39885 SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL CVSS 3.1MEDIUM 6.5
  • TI-2025-39883 SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page CVSS 3.1MEDIUM 6.1
  • TI-2022-26063 SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality CVSS 4.0CRITICAL 9.3
  • TI-2025-39880 SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module CVSS 4.0HIGH 8.6
See all 70 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences