Information disclosure in Suitecrm
CVE-2026-29108
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, an authenticated API endpoint allows any user to retrieve detailed information about any other user, including their password hash, username, and MFA configuration. As any authenticated user can query this endpoint, it's possible to retrieve and potentially crack the passwords of administrative users. Version 8.9.3 patches the issue.
Vulnerability class: Information Disclosure
EPSS: 0.003 (22.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Suitecrm
- Suitecrm Suitecrm-core — versions < 8.9.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-29108?
- CVE-2026-29108 is a medium-severity vulnerability in Suitecrm, classified under Information Disclosure. CVSS score: 6.5/10. Published 2026-03-20.
- How severe is CVE-2026-29108?
- Medium severity. CVSS v3 base score is 6.5 out of 10.