Executive Summary

This vulnerability in SuiteCRM versions 7.14.7 and prior, and 8.0.0-beta.1 through 8.9.0, is a privilege escalation issue where user sessions are not invalidated when an account is deactivated. This means that even if an administrator deactivates a user account, that user can continue to access the application if their session is still active. Moreover, the user can self-reactivate their account, bypassing administrative controls and maintaining unauthorized access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized users to maintain access to the SuiteCRM application even after their accounts have been deactivated by administrators. This undermines security controls, potentially leading to unauthorized data access, data modification, or other malicious activities within the CRM system. It can result in a high impact on confidentiality and integrity, as well as a limited impact on availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade SuiteCRM to version 7.14.8 or later, or 8.9.1 or later, where the issue is fixed. Additionally, review and invalidate all active user sessions upon account deactivation to prevent inactive users from maintaining access. Implement monitoring to detect any unauthorized account reactivations.

Useful 0 Not Useful 0