CVE-2026-63217
Undergoing Analysis Undergoing Analysis - In Progress

SuiteCRM Unauthorized Record Access via PDF Generation

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the generatePdf entry point loads an arbitrary record through BeanFactory::getBean() without checking the requesting user's record access. The affected flow begins at modules/AOS_PDF_Templates/generatePdf.php and uses generatePdf, and BeanFactory::getBean() to carry attacker-controlled data or authorization state into the security-sensitive operation. Any authenticated user can read fields from records denied by configured ACL roles, including contact, financial, deal, and custom-field data. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-63217
EUVD
EUVD-2026-117637

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SuiteCRM versions before 7.15.2 and 8.10.2 have an Insecure Direct Object Reference (IDOR) vulnerability in the generatePdf entry point. This flaw allows authenticated users to bypass role-based access controls and access sensitive data from any module without proper authorization checks.

Detection Guidance

Check SuiteCRM version with: grep -r "version" config.php. If version is below 7.15.2 or 8.10.2, the system is vulnerable. Inspect modules/AOS_PDF_Templates/generatePdf.php for BeanFactory::getBean() usage without permission checks.

Monitor for unauthorized PDF generation requests targeting sensitive modules like contacts or financial records. Review logs for repeated access attempts to restricted records.

Impact Analysis

Any authenticated user can read restricted data such as personal contact details, financial information, deals, and custom fields from records they should not access. This undermines SuiteCRM's access control mechanisms and exposes sensitive information.

Compliance Impact

This vulnerability can lead to unauthorized access to personal and sensitive data, which may violate compliance requirements such as GDPR and HIPAA. Organizations using affected versions risk data breaches and non-compliance penalties.

Mitigation Strategies

Upgrade SuiteCRM to version 7.15.2 or 8.10.2 or later immediately. Temporarily restrict access to the generatePdf endpoint by modifying .htaccess or web server rules until upgrade is complete.

Review and audit all user roles and permissions to ensure proper access controls are in place. Monitor for any signs of data exfiltration from sensitive modules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63217. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...