CVE-2026-108712 in SuiteCRM
Summary
by MITRE • 10/11/2026
SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles and per-module ACL action matrix.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The identified vulnerability represents a critical failure in access control mechanisms within SuiteCRM versions through 7.15.2 and 8.10.2, specifically affecting the DetailUserRole entry point. This flaw is classified as an insecure direct object reference or missing function level authorization, where the application fails to verify that the authenticated user has permission to access the specific resource being requested. In a properly secured system, any request for sensitive data such as Access Control List configurations must be validated against the requester's own permissions and role hierarchy. However, in this instance, the backend logic relies on an unvalidated input parameter, allowing users with basic authentication privileges to bypass administrative restrictions entirely.
The technical root cause lies in how the application handles the record identifier passed via the request parameters. When a user attempts to view details for a specific user's roles and permissions, the system accepts any valid integer or string ID provided by the client without checking if that ID belongs to the currently logged-in session owner or an entity the current user is authorized to inspect. This lack of object-level authorization check enables attackers to manipulate the record parameter to target arbitrary non-administrative users within the CRM environment. By simply substituting their own user identifier with another victim's identifier in the HTTP request, the attacker can retrieve detailed ACL data that should remain confidential and restricted to system administrators only.
The operational impact of this vulnerability is significant for organizations relying on SuiteCRM for customer relationship management and internal workflow automation. The exposed information includes assigned roles and per-module Access Control List action matrices. These structures define exactly what actions a user or role can perform within specific modules, such as creating, editing, deleting, or viewing records. Knowledge of these configurations allows an attacker to map out the security posture of other users in the system. This intelligence is particularly dangerous because it reveals which roles have elevated privileges and how permissions are distributed across different functional areas of the application. Attackers can use this data to identify high-value targets, plan privilege escalation attacks, or craft more sophisticated exploits that target specific permission gaps identified through the leaked ACL matrices.
This vulnerability aligns with CWE-284, Improper Access Control, as it involves a failure to enforce proper restrictions on an authorized actor regarding access to system resources. Furthermore, from a tactical perspective related to the MITRE ATT&CK framework, this flaw facilitates reconnaissance and privilege escalation phases of an attack lifecycle. The ability to enumerate user roles and permissions is a precursor step that aids in lateral movement within a compromised environment. It allows adversaries to understand the security boundaries they are operating within, thereby increasing their chances of successfully escalating privileges or moving laterally to other systems with higher trust levels.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade SuiteCRM to versions released after 7.15.2 and 8.10.2, where this authorization check has been implemented in the backend logic for the DetailUserRole entry point. For organizations unable to patch immediately due to compatibility constraints or other operational reasons, temporary mitigations should focus on network-level controls such as Web Application Firewalls that can detect and block requests with suspicious parameter manipulation patterns targeting user IDs. Additionally, implementing strict input validation and ensuring that all API endpoints enforce session-based ownership checks is essential. Developers must adopt a principle of least privilege by default, verifying the relationship between the authenticated principal and the requested resource before returning any sensitive configuration data. Regular security audits focusing on access control logic are also recommended to prevent similar flaws in other parts of the application.