Missing Authorization in SuiteCRM Exposes User ACL Data

Executive Summary

SuiteCRM versions through 7.15.2 and 8.10.2 have a missing authorization flaw in the DetailUserRole entry point. Authenticated non-admin users can exploit this to view other users' ACL (Access Control List) data by supplying another user's ID in the record parameter. This exposes assigned roles and per-module permissions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check SuiteCRM logs for unauthorized access attempts to the DetailUserRole entry point. Look for requests with a 'record' parameter containing another user's ID. Verify if non-admin users can access ACL data for other users by manually testing the endpoint with a non-admin account and another user's ID in the 'record' parameter.

Useful 0 Not Useful 0

Impact Analysis

An attacker with non-admin access could read sensitive user role assignments and permissions. This may allow privilege escalation, unauthorized data access, or lateral movement within the system. The impact depends on the exposed permissions but could compromise confidentiality and integrity of user data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing personal data access controls or HIPAA by revealing user permissions in healthcare systems. Non-compliance may result from unauthorized data exposure, lack of proper access controls, or failure to protect sensitive user information as required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update SuiteCRM to version 7.15.3 or 8.10.3 or later to address the missing authorization vulnerability in the DetailUserRole entry point.

Useful 0 Not Useful 0