CVE-2026-61649 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's SSRF protection compares hostnames by substring, so an authenticated user can place the server's hostname in a URL path and slip past IP validation. The attacker can then make the server send requests to internal services that should not be reachable from outside.
first public Jul 31, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted SuiteCRM installations on the affected 7.x and 8.x lines where users with accounts can trigger outbound requests from the server. The flaw needs an authenticated user and the server-side request path that uses validate_external_host(). Instances on managed hosting that the vendor patched, or that restrict outbound traffic, have less exposure.
Not affected if managed-hosting, unauthenticated-only-access
Who cares php, self-hosted, suitecrm
7.15.2 on the 7.x line and below 8.10.2 on the 8.x line are affected.7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the SSRF protection added in 7.15.1 uses a substring comparison in isSelfRequest() rather than hostname equality. The affected flow begins at validate_external_host() and uses isSelfRequest(), and stripos() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated attacker can place the server hostname in a URL path to bypass IP validation and direct server-side requests to internal services. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.