CVE-2025-64489
BaseFortify
Publication date: 2025-11-08
Last updated on: 2025-11-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| salesagility | suitecrm | to 7.14.8 (exc) |
| salesagility | suitecrm | From 8.0.0 (inc) to 8.9.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in SuiteCRM versions 7.14.7 and prior, and 8.0.0-beta.1 through 8.9.0, is a privilege escalation issue where user sessions are not invalidated when an account is deactivated. This means that even if an administrator deactivates a user account, that user can continue to access the application if their session is still active. Moreover, the user can self-reactivate their account, bypassing administrative controls and maintaining unauthorized access.
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to maintain access to the SuiteCRM application even after their accounts have been deactivated by administrators. This undermines security controls, potentially leading to unauthorized data access, data modification, or other malicious activities within the CRM system. It can result in a high impact on confidentiality and integrity, as well as a limited impact on availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade SuiteCRM to version 7.14.8 or later, or 8.9.1 or later, where the issue is fixed. Additionally, review and invalidate all active user sessions upon account deactivation to prevent inactive users from maintaining access. Implement monitoring to detect any unauthorized account reactivations.