Unauthorized Data Exposure in SuiteCRM Due to Improper Input Validation
CVE-2026-69137
7.7HIGH
What is CVE-2026-69137?
SuiteCRM exposes a vulnerability in its CalendarAccount testConnection action, allowing an authenticated user to manipulate the server_url parameter. This parameter is passed directly to a curl command without necessary validation of the host, address, or scheme, which can lead to significant security risks. Attackers may exploit this flaw to execute unauthorized operations, gain access to internal service data, enumerate services, or even retrieve sensitive cloud metadata. Versions 7.15.2 and 8.10.2 contain patches that mitigate this vulnerability.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2