Auth bypass in Salesagility Suitecrm
CVE-2025-64490
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 allow a low-privileged user with a restrictive role to view and create work items through the Resource Calendar and project screens, even when the related modules (Projects, Project Tasks, Tasks, Leads, Accounts, Meetings, Calls) are explicitly set to Disabled/None in Role Management. This indicates inconsistent ACL/RBAC enforcement across modules and views, resulting in unauthorized data exposure and modification. This issue is fixed in versions 7.14.8 and 8.9.1.
Vulnerability class: Broken Access Control
EPSS: 0.003 (17.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L.
Affected products
- Salesagility Suitecrm
- Suitecrm — versions < 7.14.8, >= 8.0.0-beta.1, < 8.9.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-64490?
- CVE-2025-64490 is a high-severity vulnerability in Salesagility Suitecrm, classified under Incorrect Authorization. CVSS score: 8.3/10. Published 2025-11-08.
- How severe is CVE-2025-64490?
- High severity. CVSS v3 base score is 8.3 out of 10.