CVE-2026-63218 in SuiteCRM
Summary
by MITRE • 11/05/2026
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the record-level access check enforced by DetailView. The affected flow begins at AOR_Reports and uses changeReportPage, and DetailView to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can directly invoke the action and read report rows and restricted-module data despite owner-only or role-based report visibility. This issue is fixed in versions 7.15.2 and 8.10.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
SuiteCRM, a widely deployed open-source Customer Relationship Management platform, suffered from an authorization bypass vulnerability affecting versions prior to 7.15.2 and 8.10.2. The core of the issue resides within the changeReportPage controller action, which is responsible for rendering report pages based on user input or session state. In these vulnerable iterations, the implementation failed to enforce record-level access controls when generating reports, creating a significant discrepancy between how data was handled in standard detail views versus report generation workflows. This architectural inconsistency allowed authenticated users to bypass intended security restrictions that were otherwise enforced by the DetailView component, leading to unauthorized data exposure.
The technical flaw stems from an incomplete implementation of role-based and owner-based access checks within the reporting module's execution flow. The vulnerability is triggered through a specific sequence starting at AOR_Reports, where the changeReportPage action processes attacker-controlled parameters or manipulates authorization states before passing them into security-sensitive operations. Unlike standard record views which rigorously validate that a user has permission to view specific records based on ownership rules or role assignments, this particular controller action omitted these critical checks. Consequently, an authenticated user could directly invoke the endpoint and retrieve rows from reports that were explicitly configured for restricted access, such as those limited to owners only or specific organizational roles.
The operational impact of this vulnerability is severe, particularly in enterprise environments where data sensitivity varies across departments and hierarchical levels. Attackers with valid credentials can exfiltrate confidential customer information, sales pipelines, or internal metrics that are not meant to be visible to their user account level. This represents a classic case of broken access control, allowing lateral movement within the application's data layer without requiring privilege escalation at the system level. The ability to read restricted-module data undermines the integrity and confidentiality guarantees provided by SuiteCRM’s security model, potentially leading to regulatory non-compliance if sensitive personal or financial data is exposed.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in enforcing object-level permissions during dynamic content generation. From a threat modeling perspective using MITRE ATT&CK techniques, this behavior corresponds to T1078 Valid Accounts and potentially T1530 Data from Cloud Storage if the reports contain exported data artifacts. To mitigate this risk, organizations must immediately upgrade SuiteCRM to version 7.15.2 or later where the changeReportPage action has been patched to include consistent record-level access verification. Additionally, administrators should audit existing report configurations and review user permissions to ensure that no sensitive workflows remain exposed through alternative entry points until all systems are updated.