CVE-2026-29189

Published: Mar 20, 2026Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL (Access Control List) checks on several endpoints, allowing authenticated users to access and manipulate data they should not have permission to interact with. Versions 7.15.1 and 8.9.3 patch the issue.

Affected (2)

Products: Suitecrm: Suitecrm

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Suitecrm Suitecrm	Before 7.15.1
Suitecrm Suitecrm	From 8.0.0 to 8.9.3

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://docs.suitecrm.com/admin/releases/7.15.x

Source: security-advisories@github.com

Release Notes

https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-m6x8-3hxp-qxwv

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.