Access Control Vulnerability in SuiteCRM Software by SuiteCRM

CVE-2026-32697

What is CVE-2026-32697?

SuiteCRM, an open-source enterprise-grade customer relationship management software, has a significant access control issue in its RecordHandler::getRecord() method. This flaw allows unauthorized users to retrieve any record based on module and ID without proper checks on the user's view permissions. Unlike the saveRecord() method, which appropriately enforces save permissions through an ACL check, the getRecord() method lacks an equivalent view permission validation, creating potential data exposure risks. The issue has been addressed in version 8.9.3, underscoring the importance for users to update to this version to safeguard their data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References