Authenticated Users Can Modify EmailMarketing Records in SuiteCRM

Executive Summary

SuiteCRM versions through 7.15.2 and 8.x through 8.10.2 have a missing authorization vulnerability. Authenticated users can create or modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point. Low-privileged users who are denied Campaigns access can still post marketingId, campaignId, and templateId to reattach marketing messages or change the template used in campaign emails.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthorized EmailMarketing record modifications in SuiteCRM. Review application logs for POST requests to the setCampaignMarketingAndTemplate entry point by low-privileged users. Inspect database tables for unexpected changes to marketingId, campaignId, or templateId fields.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could modify email marketing campaigns, potentially sending unauthorized messages or altering templates. This could lead to misinformation, phishing risks, or reputational damage if abused.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data processing or communication, violating GDPR's principles of lawfulness and transparency. For HIPAA, it may risk exposing protected health information if email campaigns are tampered with.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SuiteCRM to the latest patched version (7.15.3 or 8.10.3+). Apply strict access controls to prevent low-privileged users from modifying EmailMarketing records. Monitor and audit all changes to marketing campaigns and templates.

Useful 0 Not Useful 0