{"id":"CVE-2026-61649","kind":"vulnerability","aliases":["CVE-2026-61649"],"related":[],"title":"SuiteCRM: substring host check lets authenticated users reach internal services","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the SSRF protection added in 7.15.1 uses a substring comparison in isSelfRequest() rather than hostname equality. The affected flow begins at validate_external_host() and uses isSelfRequest(), and stripos() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated attacker can place the server hostname in a URL path to bypass IP validation and direct server-side requests to internal services. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's SSRF protection compares hostnames by substring, so an authenticated user can place the server's hostname in a URL path and slip past IP validation. The attacker can then make the server send requests to internal services that should not be reachable from outside.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","suitecrm"],"not_affected_if":["managed-hosting","unauthenticated-only-access"],"how_to_check":"- Check the installed SuiteCRM version in the admin panel or the application's version file; versions below `7.15.2` on the 7.x line and below `8.10.2` on the 8.x line are affected.\n- Confirm whether the instance is reachable from the internet with a login account available to users.","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:17:22+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","triaged_at":"2026-11-05T19:42:57+00:00","updated_at":"2026-11-05T19:42:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T19:42:57Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"internet","title":"SuiteCRM: substring host check lets authenticated users reach internal services","impact":"medium","summary":"SuiteCRM's SSRF protection compares hostnames by substring, so an authenticated user can place the server's hostname in a URL path and slip past IP validation. The attacker can then make the server send requests to internal services that should not be reachable from outside.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user reaches internal services through the server","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version in the admin panel or the application's version file; versions below `7.15.2` on the 7.x line and below `8.10.2` on the 8.x line are affected.\n- Confirm whether the instance is reachable from the internet with a login account available to users.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","unauthenticated-only-access"],"who_is_affected":"Self-hosted SuiteCRM installations on the affected 7.x and 8.x lines where users with accounts can trigger outbound requests from the server. The flaw needs an authenticated user and the server-side request path that uses validate_external_host(). Instances on managed hosting that the vendor patched, or that restrict outbound traffic, have less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4415,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-61649':13A,16A '7.15.1':94C '7.15.2':86C,164C '8.10.2':88C,166C 'add':92C 'affect':106C 'applic':83C 'attack':51B,121C,135C 'attacker-control':120C 'authent':6A,33B,134C 'author':125C 'begin':108C 'bypass':146C 'carri':119C 'check':4A 'compar':27B 'comparison':98C 'control':122C 'crm':81C 'custom':78C 'cve':11A,14A 'data':123C 'direct':150C 'enterpris':76C 'enterprise-readi':75C 'equal':104C 'extern':111C 'fix':161C 'flow':107C 'host':3A,21B,112C 'hostnam':28B,40B,103C,140C 'intern':9A,60B,156C 'ip':48B,147C 'isselfrequest':100C,115C 'issu':159C 'let':5A 'make':54B 'manag':80C 'open':73C 'open-sourc':72C 'oper':132C 'outsid':68B 'packag':17B 'past':47B 'path':44B,144C 'php':18B 'place':36B,137C 'prior':84C 'protect':26B,91C 'rather':101C 'reach':8A 'reachabl':66B 'readi':77C 'relationship':79C 'request':58B,154C 'secur':130C 'security-sensit':129C 'self':20B 'self-host':19B 'send':57B 'sensit':131C 'server':38B,56B,139C,152C 'server-sid':151C 'servic':10A,61B,157C 'side':153C 'slip':46B 'softwar':82C 'sourc':74C 'ssrf':25B,90C 'state':126C 'stripo':117C 'substr':2A,30B,97C 'suitecrm':1A,22B,23B,69C 'url':43B,143C 'use':95C,114C 'user':7A,34B 'valid':49B,110C,148C 'version':163C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted SuiteCRM installations on the affected 7.x and 8.x lines where users with accounts can trigger outbound requests from the server. The flaw needs an authenticated user and the server-side request path that uses validate_external_host(). Instances on managed hosting that the vendor patched, or that restrict outbound traffic, have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","php","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-07-31T14:15:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61649","severity":null,"published_at":"2026-11-05T19:17:22+00:00","modified_at":"2026-11-05T19:17:22+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","fetched_at":"2026-11-05T19:40:37+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79238,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-r665-27q3-wvg8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-31T14:15:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}