CVE-2026-69137
Undergoing Analysis Undergoing Analysis - In Progress

Server URL Validation Bypass in SuiteCRM

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly to curl without host, address, or scheme validation. The affected flow begins at CalendarAccount::action_testConnection and uses server_url, CalDAVProvider::makeCalDAVRequest(), and PROPFIND to carry attacker-controlled data or authorization state into the security-sensitive operation. The server sends a PROPFIND request from its network context and returns non-success response bodies, enabling internal-service access, partial response disclosure, service enumeration, and possible cloud metadata access. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-69137
EUVD
EUVD-2026-117658

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SuiteCRM has an authenticated Server-Side Request Forgery (SSRF) vulnerability in the CalendarAccount::action_testConnection endpoint. It allows authenticated users to pass a server_url parameter without proper validation, enabling them to make HTTP requests to arbitrary internal or external hosts. The server issues a PROPFIND request to the supplied URL, and non-success responses leak partial data in error messages.

Detection Guidance

Check SuiteCRM version with: grep -r "version" config.php. If <= 7.15.1 or <= 8.10.1, the system is vulnerable. Monitor network logs for unusual PROPFIND requests originating from SuiteCRM. Test the CalendarAccount::action_testConnection endpoint by sending a crafted server_url parameter to observe internal network access or response leakage.

Commands to detect: curl -u admin:password -X POST 'http://suitecrm/soap/soap.php' -d 'method=CalendarAccount.action_testConnection&server_url=http://internal-service' | grep -i 'response'.

Impact Analysis

This vulnerability allows attackers to access internal services, cloud metadata endpoints, and loopback addresses. It can lead to internal network access, partial response disclosure, service enumeration, and possible cloud metadata access. The impact includes bypassing network segmentation controls and leaking sensitive data through error messages.

Mitigation Strategies

Upgrade SuiteCRM to version 7.15.2 or 8.10.2 immediately. If upgrading is not possible, restrict access to the CalendarAccount::action_testConnection endpoint via firewall rules or disable it entirely. Review and audit all authenticated user roles to limit privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...