BaseFortify

Publication date: 2025-11-08

Last updated on: 2025-11-25

Assigner: GitHub, Inc.

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account deactivation. An inactive user with an active session can continue to access the application and, critically, can self-reactivate their account. This undermines administrative controls and allows unauthorized persistence. This issue is fixed in versions 7.14.8 and 8.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-08

Last Modified

2025-11-25

Generated

2026-07-06

AI Q&A

2025-11-08

EPSS Evaluated

2026-07-04

NVD

CVE-2025-64489

Affected Vendors & Products

Vendor	Product	Version / Range
salesagility	suitecrm	to 7.14.8 (exc)
salesagility	suitecrm	From 8.0.0 (inc) to 8.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in SuiteCRM versions 7.14.7 and prior, and 8.0.0-beta.1 through 8.9.0, is a privilege escalation issue where user sessions are not invalidated when an account is deactivated. This means that even if an administrator deactivates a user account, that user can continue to access the application if their session is still active. Moreover, the user can self-reactivate their account, bypassing administrative controls and maintaining unauthorized access.

Impact Analysis

This vulnerability can allow unauthorized users to maintain access to the SuiteCRM application even after their accounts have been deactivated by administrators. This undermines security controls, potentially leading to unauthorized data access, data modification, or other malicious activities within the CRM system. It can result in a high impact on confidentiality and integrity, as well as a limited impact on availability.

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade SuiteCRM to version 7.14.8 or later, or 8.9.1 or later, where the issue is fixed. Additionally, review and invalidate all active user sessions upon account deactivation to prevent inactive users from maintaining access. Implement monitoring to detect any unauthorized account reactivations.

Hi! I’m here to help you understand CVE-2025-64489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70