Missing authorization in SuiteCRM campaign marketing entry point
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization flaw (CWE-862) in the setCampaignMarketingAndTemplate entry point. An authenticated low-privileged user who is denied access to Campaigns can create and modify EmailMarketing records, reattaching marketing messages or swapping the template that EmailMan sends in campaign emails.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point. Low-privileged users denied Campaigns access can post marketingId, campaignId, and templateId to reattach marketing messages or swap the template EmailMan sends in campaign emails.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for SuiteCRM.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108713
- 2026-10-11 Alias added: GHSA-8vgh-x9vp-8w93
- 2026-10-18 CISA SSVC decision points changed
References
Other 4
- https://github.com/SuiteCRM/SuiteCRM/blob/v7.15.2/modules/Campaigns/WizardCampaignSave.php#L88-L122
- https://github.com/SuiteCRM/SuiteCRM/blob/v7.15.2/include/MVC/Controller/entry_point_registry.php#L93
- https://github.com/SuiteCRM/SuiteCRM-Core/blob/v8.10.2/public/legacy/modules/Campaigns/WizardCampaignSave.php#L88-L113
- https://github.com/SuiteCRM/SuiteCRM
More SuiteCRM vulnerabilities
- TI-2019-15717 SuiteCRM 7.10.7 SQL Injection via record Parameter CVSS 4.0HIGH 7.1
- TI-2019-15716 SuiteCRM 7.10.7 SQL Injection via parentTab Parameter CVSS 4.0HIGH 7.1
- TI-2025-39885 SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL CVSS 3.1MEDIUM 6.5
- TI-2025-39883 SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page CVSS 3.1MEDIUM 6.1
- TI-2026-70691 Missing authorization in SuiteCRM DetailUserRole exposes user ACL data CVSS 4.0MEDIUM 5.3
- TI-2022-26063 SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-108713 · CVE Program
- CVE-2026-108713 · NVD
- FIRST EPSS
- GHSA-8vgh-x9vp-8w93 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences