Authorization Bypass in SuiteCRM Software

CVE-2026-63218

What is CVE-2026-63218?

SuiteCRM, an open-source Customer Relationship Management (CRM) application, contains a vulnerability in the changeReportPage controller action that allows authenticated users to access protected reports without the necessary record-level access checks. This security issue arises from a flaw that lets attacker-controlled data bypass the security mechanisms, exposing sensitive report data across restricted modules, despite intended owner-only or role-based visibility restrictions. The vulnerability is addressed in versions 7.15.2 and 8.10.2, reinforcing the importance of updating to these versions to ensure data integrity and security.

References