Auth bypass in Suitecrm

CVE-2026-63217

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the generatePdf entry point loads an arbitrary record through BeanFactory::getBean() without checking the requesting user's record access. The affected flow begins at modules/AOS_PDF_Templates/generatePdf.php and uses generatePdf, and BeanFactory::getBean() to carry attacker-controlled data or authorization state into the security-sensitive operation. Any authenticated user can read fields from records denied by configured ACL roles, including contact, financial, deal, and custom-field data. This issue is fixed in versions 7.15.2 and 8.10.2.

Vulnerability class: IDOR (Insecure Direct Object Reference)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

  • Suitecrm — versions < 7.15.2, >= 8.0.0, < 8.10.2

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-63217?
CVE-2026-63217 is a medium-severity vulnerability in Suitecrm, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-11-05.
How severe is CVE-2026-63217?
Medium severity. CVSS v3 base score is 6.5 out of 10.