CVE-2026-69144
Undergoing Analysis Undergoing Analysis - In Progress

Path Traversal in SuiteCRM via Document Download

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved and served without checking its parent document. A low-privileged authenticated user can use this identifier confusion to download administrator-owned or otherwise protected documents. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-69144
EUVD
EUVD-2026-117659

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-69144 is an authorization bypass vulnerability in SuiteCRM affecting versions before 7.15.2 and 8.10.2. The issue occurs in download.php where the system checks authorization against a Documents bean before verifying if the provided identifier is a document_revision.id. By submitting a revision UUID with type=Documents, an attacker can bypass access controls and download protected documents, including those owned by administrators.

Detection Guidance

To detect this vulnerability, check SuiteCRM versions for affected releases (7.15.1 and earlier, 8.10.1 and earlier). Inspect download.php for improper authorization checks on document revisions. Monitor logs for unauthorized document access attempts or unusual download patterns.

Impact Analysis

A low-privileged authenticated user could exploit this flaw to access sensitive documents they are not authorized to view. This includes administrator-owned files or other protected documents within the SuiteCRM system. The impact is limited to data exposure with no direct modification or deletion capabilities.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal or health data, violating GDPR and HIPAA compliance requirements. Organizations using affected SuiteCRM versions may face data breach liabilities, regulatory penalties, and reputational damage due to compromised confidentiality of protected information.

Mitigation Strategies

Immediately upgrade SuiteCRM to versions 7.15.2 or 8.10.2 or later. Apply the security patches from the official SuiteCRM releases. Review and restrict document access permissions. Monitor for suspicious activity and unauthorized document downloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...