CVE-2026-61649
Awaiting Analysis Awaiting Analysis - Queue

SSRF Bypass via Hostname Substring in SuiteCRM

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the SSRF protection added in 7.15.1 uses a substring comparison in isSelfRequest() rather than hostname equality. The affected flow begins at validate_external_host() and uses isSelfRequest(), and stripos() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated attacker can place the server hostname in a URL path to bypass IP validation and direct server-side requests to internal services. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-61649
EUVD
EUVD-2026-117640

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61649 is a Server-Side Request Forgery (SSRF) vulnerability in SuiteCRM versions before 7.15.2 and 8.10.2. The issue stems from improper SSRF protection in the isSelfRequest() function, which uses substring comparison instead of exact hostname matching. This allows attackers to embed the server's hostname in a URL path to bypass IP validation and send unauthorized requests to internal services.

Detection Guidance

To detect this vulnerability, check if your SuiteCRM instance is running a vulnerable version (7.15.1 or 8.10.1 or earlier). Review server logs for unusual outbound requests or internal service access attempts. No specific commands are provided in the context.

Impact Analysis

An authenticated attacker could exploit this to access internal services, potentially stealing sensitive data or interacting with backend systems. The high CVSS score of 7.7 indicates significant risk due to low attack complexity and no required user interaction.

Mitigation Strategies

Upgrade SuiteCRM to version 7.15.2 or 8.10.2 or later immediately. Disable or restrict access to internal services until patched. Monitor network traffic for suspicious outbound requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...