Server-Side Request Forgery (SSRF) in SuiteCRM - CVE-2026-63111
Published: August 1, 2026
Vulnerability identifier: #VU140691
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-63111
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
SuiteCRM
SuiteCRM
Detailed vulnerability description
The vulnerability allows a remote user to perform server-side request forgery.
The vulnerability exists due to missing authorization in the SchedulersJobs REST API and SchedulersJob bean when creating SchedulersJobs records with an arbitrary target value. A remote user can create a crafted SchedulersJobs record with a url:: target to perform server-side request forgery.
The injected job is executed by cron.php under the system admin user context, which can allow access to internal network hosts, localhost services, and cloud metadata endpoints. Injected jobs may also persist in the job queue and be configured with recurring schedules.
How to mitigate CVE-2026-63111
Install security update from vendor's website.