Authorization Flaw in SuiteCRM Affects User Data Access
CVE-2026-63217
6.5MEDIUM
What is CVE-2026-63217?
SuiteCRM, a widely-used open-source CRM solution, has a vulnerability in its generatePdf entry point that allows authenticated users to bypass Access Control Lists (ACLs). Specifically, the BeanFactory::getBean() method does not properly validate user permissions when loading records, enabling unauthorized access to sensitive information such as contact and financial data. This flaw is present in versions before 7.15.2 and 8.10.2, and users are strongly advised to upgrade to these versions to mitigate potential data exposure risks.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2