CVE-2026-69137 in SuiteCRM
Summary
by MITRE • 11/05/2026
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly to curl without host, address, or scheme validation. The affected flow begins at CalendarAccount::action_testConnection and uses server_url, CalDAVProvider::makeCalDAVRequest(), and PROPFIND to carry attacker-controlled data or authorization state into the security-sensitive operation. The server sends a PROPFIND request from its network context and returns non-success response bodies, enabling internal-service access, partial response disclosure, service enumeration, and possible cloud metadata access. This issue is fixed in versions 7.15.2 and 8.10.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
SuiteCRM serves as a widely deployed open-source Customer Relationship Management platform used by numerous organizations to manage customer interactions and data. A critical security vulnerability was identified within the CalendarAccount module, specifically affecting versions prior to 7.15.2 and 8.10.2. This flaw centers on the testConnection action, which is designed to verify connectivity with external CalDAV servers for calendar synchronization purposes. The core technical deficiency lies in how this function handles user-supplied input. When an authenticated administrator or user initiates a connection test by providing a server URL, the application passes this value directly into PHP's cURL library without performing any validation on the host address, IP range, or protocol scheme. This lack of sanitization allows for Server-Side Request Forgery attacks, where the attacker can manipulate the target destination of requests initiated by the backend server itself rather than the client browser.
The exploitation path begins at the CalendarAccount::action_testConnection endpoint and flows through CalDAVProvider::makeCalDAVRequest(), which constructs a PROPFIND request to test the availability of the specified CalDAV service. Because the application does not restrict outbound connections, an attacker can supply URLs pointing to internal network services that are otherwise inaccessible from external networks or restricted by firewalls. By controlling the server_url parameter, the attacker forces the SuiteCRM server to send HTTP requests to arbitrary destinations within the organization's infrastructure. This capability enables several malicious outcomes including unauthorized access to internal administrative interfaces, enumeration of running services on private IP ranges, and potential disclosure of sensitive response bodies from internal applications that may leak configuration details or user data.
Furthermore, this vulnerability facilitates cloud metadata access when SuiteCRM is deployed in cloud environments such as Amazon Web Services or Microsoft Azure. Many cloud providers expose instance metadata endpoints at well-known local addresses like 169.254.169.254. By directing the cURL request to these internal metadata URLs, an attacker can retrieve sensitive information including temporary security credentials, IAM roles, and other configuration data that could lead to full compromise of the cloud infrastructure hosting the CRM application. The impact is severe because it allows authenticated users with access to calendar settings to pivot from a web application vulnerability into broader network reconnaissance or lateral movement within the internal environment. This aligns with CWE-918 which addresses Server-Side Request Forgery, and maps to MITRE ATT&CK techniques related to Discovery such as Network Service Scanning and Cloud Metadata API queries.
The operational impact extends beyond mere information disclosure. Successful exploitation can lead to unauthorized access to sensitive business data stored in internal systems that interact with the CRM via CalDAV or other protocols. It also poses a risk of blind SSRF where attackers might trigger requests to vulnerable internal services, potentially leading to remote code execution if those services have their own flaws. Mitigation strategies primarily involve upgrading SuiteCRM to version 7.15.2 or later where this validation logic has been implemented. For organizations unable to upgrade immediately, network-level controls such as egress filtering can be employed to restrict outbound connections from the web server IP address to only known and necessary external domains. Additionally, implementing strict input validation on all user-supplied URLs that are processed by backend request libraries is essential to prevent similar vulnerabilities in other modules or future updates.