CVE-2026-63217 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's generatePdf entry point loads any record by ID without checking the requesting user's access rights. An authenticated user can read contact, financial, deal and custom-field data from records their ACL roles deny.
first public Jul 31, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any SuiteCRM installation below 7.15.2 or 8.10.2 is exposed, to any user with a login, since the flaw is in the PDF template generation path. Installations where only trusted staff have accounts and records are not sensitive are lower risk. Hosted SaaS deployments are handled by the vendor.
Not affected if managed-hosting, patched-version
Who cares php, self-hosted, suitecrm
composer.json; versions before 7.15.2 and before 8.10.2 are affected.modules/AOS_PDF_Templates/generatePdf.php exists in the install.7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the generatePdf entry point loads an arbitrary record through BeanFactory::getBean() without checking the requesting user's record access. The affected flow begins at modules/AOS_PDF_Templates/generatePdf.php and uses generatePdf, and BeanFactory::getBean() to carry attacker-controlled data or authorization state into the security-sensitive operation. Any authenticated user can read fields from records denied by configured ACL roles, including contact, financial, deal, and custom-field data. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.