SB2026080113 - Multiple vulnerabilities in SuiteCRM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080113

SB2026080113 - Multiple vulnerabilities in SuiteCRM

Published: August 1, 2026

Security Bulletin ID SB2026080113
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 64% Low 36%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Incorrect authorization (CVE-ID: CVE-2026-63218)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to incorrect authorization in the AOR_Reports changeReportPage controller action when handling direct calls to non-view controller actions for protected records. A remote user can send a direct request to changeReportPage to disclose sensitive information.

DetailView correctly denies access, but changeReportPage renders the full report body and row data without a per-record ACL check.


2) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-63217)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through user-controlled key in the generatePdf entry point when loading records by user-supplied identifiers. A remote user can request a record they are not authorized to access to disclose sensitive information.

The issue bypasses role-based access control for data reads and can expose all field values from records across any module, including custom fields.


3) Missing Authorization (CVE-ID: CVE-2026-61650)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to modify security-relevant relationships and ownership fields on records they should not be able to edit.

The vulnerability exists due to missing authorization in the V8 relationship creation endpoint when handling POST requests to create one-to-many relationships. A remote user can send a specially crafted relationship creation request to modify security-relevant relationships and ownership fields on records they should not be able to edit.

For one-to-many relationships, creating the relationship writes the right-hand-side foreign key into the target record, turning a read-only relationship action into an unauthorized record modification.


4) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-61649)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to access internal services via server-side request forgery.

The vulnerability exists due to improper restriction of outbound requests in isSelfRequest() when validating external hosts. A remote user can supply a crafted URL containing the server hostname in the path component to access internal services via server-side request forgery.

This issue is caused by substring matching with stripos() instead of hostname equality, which allows bypass of IP validation.


5) SQL injection (CVE-ID: CVE-2026-61651)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to disclose sensitive information and modify data.

The vulnerability exists due to SQL injection in the get_end_date action in Projects Controller when handling the task_id parameter. A remote user can send a specially crafted request to disclose sensitive information and modify data.

The issue may be exploited using blind SQL injection techniques to enumerate database schema and dump database contents.


6) SQL injection (CVE-ID: CVE-2026-61653)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in modules/Campaigns/PopupCampaignRoi.php when handling the $_REQUEST['id'] parameter. A remote user can send a specially crafted request to disclose sensitive information.

The issue can be exploited through time-based blind SQL injection, and access to the Campaigns module is required.


7) SQL injection (CVE-ID: CVE-2026-61648)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to SQL injection in modules/AOR_Reports/AOR_Report.php when processing the parameter_value[0] request parameter for user-controllable Multi report conditions. A remote user can send a specially crafted request to disclose sensitive information and cause a denial of service.

The issue is exploitable through time-based blind and UNION-based SELECT injection.


8) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-63111)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to perform server-side request forgery.

The vulnerability exists due to missing authorization in the SchedulersJobs REST API and SchedulersJob bean when creating SchedulersJobs records with an arbitrary target value. A remote user can create a crafted SchedulersJobs record with a url:: target to perform server-side request forgery.

The injected job is executed by cron.php under the system admin user context, which can allow access to internal network hosts, localhost services, and cloud metadata endpoints. Injected jobs may also persist in the job queue and be configured with recurring schedules.


9) SQL injection (CVE-ID: CVE-2026-63215)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to disclose sensitive information and modify data.

The vulnerability exists due to SQL injection in the REST API v4.1 get_entry_list method when handling crafted requests to /service/v4_1/rest.php. A remote user can send a specially crafted request to disclose sensitive information and modify data.

The issue is time-based blind and requires authenticated access.


10) SQL injection (CVE-ID: CVE-2026-63214)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to disclose sensitive information and compromise the platform.

The vulnerability exists due to SQL injection in the legacy REST API /service/v4_1/rest.php when processing a crafted query parameter in methods such as get_entry_list and get_entries_count. A remote user can supply a crafted query parameter to disclose sensitive information and compromise the platform.

Exploitation requires a valid SuiteCRM user account and list ACL permission on at least one module.


11) Path traversal (CVE-ID: CVE-2026-63213)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to write arbitrary files and execute arbitrary code.

The vulnerability exists due to path traversal in the Upgrade Wizard commit flow when processing a tampered final install request containing the hidden zip_to_dir parameter. A remote privileged user can modify the zip_to_dir parameter to copy extracted package files to an attacker-chosen path outside the intended upgrade destination to write arbitrary files and execute arbitrary code.

The issue is limited to the Upgrade Wizard commit phase and can also be used to overwrite application files or corrupt configuration and code files.


Remediation

Install update from vendor's website.

References