Server-Side Request Forgery in SuiteCRM Affects Internal Service Security
CVE-2026-61649
7.7HIGH
What is CVE-2026-61649?
SuiteCRM, an open-source Customer Relationship Management (CRM) software, is susceptible to a Server-Side Request Forgery (SSRF) vulnerability due to an ineffective validation mechanism in its request handling. The flaw, present in versions prior to 7.15.2 and 8.10.2, allows an authenticated attacker to exploit the validate_external_host() function. This exploitation can bypass IP validation by manipulating the request path with a server hostname, which could potentially redirect server-side requests to sensitive internal services. The vulnerability has been addressed in versions 7.15.2 and 8.10.2.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2