CVE-2026-108713 in SuiteCRM
Summary
by MITRE • 10/11/2026
SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point. Low-privileged users denied Campaigns access can post marketingId, campaignId, and templateId to reattach marketing messages or swap the template EmailMan sends in campaign emails.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified within SuiteCRM versions through 7.15.2 and 8.x through 8.10.2 represents a critical failure in access control mechanisms, specifically classified under CWE-269 Improper Privilege Management or more precisely CWE-862 Missing Authorization. This flaw resides within the application's handling of email marketing functionalities, particularly affecting the setCampaignMarketingAndTemplate entry point. The core issue is that the system fails to adequately verify whether an authenticated user possesses the necessary permissions to perform actions on specific campaign-related resources. While SuiteCRM implements role-based access control to restrict certain administrative and operational features based on user roles, this particular endpoint does not enforce these restrictions effectively when processing requests related to email marketing campaigns.
An attacker who has obtained valid credentials for a low-privileged account can exploit this missing authorization check. Specifically, users who are explicitly denied access to Campaigns due to their role limitations can still interact with the underlying data structures by directly invoking API endpoints or manipulating HTTP requests sent to the setCampaignMarketingAndTemplate function. By posting parameters such as marketingId, campaignId, and templateId, these unauthorized users can reattach existing marketing messages to campaigns they do not own or modify the email templates used in those campaigns. This bypasses the intended security boundaries designed to isolate data between different user roles within the organization.
The operational impact of this vulnerability is significant for organizations relying on SuiteCRM for their customer relationship management and automated marketing efforts. An attacker with low-level access can compromise the integrity of marketing communications by swapping out email templates. This could lead to the dissemination of malicious content, phishing emails disguised as legitimate corporate communications, or simply the disruption of planned marketing campaigns. Furthermore, the ability to reattach marketing messages allows an adversary to manipulate campaign metrics and analytics data, potentially obscuring their activities or causing misleading reports for management. In a broader security context, this vulnerability aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate credentials, and relates to T1496 Resource Hijacking if the compromised campaigns are used for malicious purposes such as spamming or phishing operations against external parties.
Mitigation strategies must focus on immediate patching and enhanced access control verification. Administrators should upgrade SuiteCRM to a version where this vulnerability has been remediated by the vendor, ensuring that all security patches related to role-based access controls in email marketing modules are applied. In environments where upgrading is not immediately feasible, network-level mitigations such as Web Application Firewalls can be configured to monitor and restrict direct API calls to sensitive endpoints like setCampaignMarketingAndTemplate from low-privileged user sessions. Additionally, developers should review the implementation of authorization checks for all entry points handling campaign data to ensure that permission validations are performed consistently before any state-changing operations occur. Regular audits of user permissions and activity logs can also help in detecting anomalous behavior indicative of exploitation attempts against this vulnerability.