CVE-2026-63218
Undergoing Analysis Undergoing Analysis - In Progress

Information Disclosure in SuiteCRM via Report Access Bypass

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the record-level access check enforced by DetailView. The affected flow begins at AOR_Reports and uses changeReportPage, and DetailView to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can directly invoke the action and read report rows and restricted-module data despite owner-only or role-based report visibility. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-63218
EUVD
EUVD-2026-117634

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SuiteCRM versions before 7.15.2 and 8.10.2 have a flaw in the AOR_Reports module. An authenticated user can bypass record-level access controls by directly invoking the changeReportPage action, which renders protected report data without proper checks. This exposes sensitive information despite owner-only or role-based visibility settings.

Detection Guidance

To detect this vulnerability, check your SuiteCRM version. If you are running SuiteCRM 7.15.1 or earlier, or 8.10.1 or earlier, your system is vulnerable. You can verify the version by checking the config.php file in your SuiteCRM installation directory or by navigating to the admin panel and looking at the system information.

Impact Analysis

An attacker with low privileges could access restricted report data, including sensitive records from other modules. This could lead to unauthorized data disclosure, potential data leaks, or compliance violations depending on the exposed information.

Compliance Impact

This vulnerability could result in unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's privacy rules. Organizations using affected SuiteCRM versions may face compliance risks and potential regulatory penalties.

Mitigation Strategies

Immediately upgrade SuiteCRM to version 7.15.2 or 8.10.2 or later. If upgrading is not immediately possible, restrict access to the AOR_Reports module and review report permissions to minimize exposure. Ensure all users follow the principle of least privilege.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63218. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...