Authorization Flaw in SuiteCRM Allows Document Access
CVE-2026-69144

6.5MEDIUM

Key Information:

Vendor

Suitecrm

Status
Suitecrm
Vendor
CVE Published:
5 November 2026

What is CVE-2026-69144?

SuiteCRM, a widely used open-source Customer Relationship Management software, contains an authorization flaw within its download.php functionality. Versions prior to 7.15.2 and 8.10.2 improperly validate the identifier against a Documents bean, potentially allowing low-privileged authenticated users to download sensitive documents owned by administrators. This exploit arises when a UUID for a document revision is submitted, leading to unauthorized access to documents without verifying the associated parent document. The vulnerability has been addressed in subsequent releases, strengthening the overall security posture of the application.

Affected Version(s)

SuiteCRM < 7.15.2 < 7.15.2

SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2

References

https://github.com/SuiteCRM/SuiteCRM/security/advisories/...
x_refsource_CONFIRM
https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f5018...
x_refsource_MISC
https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159e...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.