{"id":"CVE-2026-63217","kind":"vulnerability","aliases":["CVE-2026-63217"],"related":[],"title":"SuiteCRM: PDF generator lets any logged-in user read ACL-denied records","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the generatePdf entry point loads an arbitrary record through BeanFactory::getBean() without checking the requesting user's record access. The affected flow begins at modules/AOS_PDF_Templates/generatePdf.php and uses generatePdf, and BeanFactory::getBean() to carry attacker-controlled data or authorization state into the security-sensitive operation. Any authenticated user can read fields from records denied by configured ACL roles, including contact, financial, deal, and custom-field data. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's generatePdf entry point loads any record by ID without checking the requesting user's access rights. An authenticated user can read contact, financial, deal and custom-field data from records their ACL roles deny.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","suitecrm"],"not_affected_if":["managed-hosting","patched-version"],"how_to_check":"- Check the installed SuiteCRM version in the application's about page or `composer.json`; versions before `7.15.2` and before `8.10.2` are affected.\n- Confirm the file `modules/AOS_PDF_Templates/generatePdf.php` exists in the install.","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:17:23+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","triaged_at":"2026-11-05T19:43:21+00:00","updated_at":"2026-11-05T19:43:21+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T19:43:21Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"network","title":"SuiteCRM: PDF generator lets any logged-in user read ACL-denied records","impact":"medium","summary":"SuiteCRM's generatePdf entry point loads any record by ID without checking the requesting user's access rights. An authenticated user can read contact, financial, deal and custom-field data from records their ACL roles deny.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users read ACL-restricted contact and financial records","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version in the application's about page or `composer.json`; versions before `7.15.2` and before `8.10.2` are affected.\n- Confirm the file `modules/AOS_PDF_Templates/generatePdf.php` exists in the install.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","patched-version"],"who_is_affected":"Any SuiteCRM installation below 7.15.2 or 8.10.2 is exposed, to any user with a login, since the flaw is in the PDF template generation path. Installations where only trusted staff have accounts and records are not sensitive are lower risk. Hosted SaaS deployments are handled by the vendor.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000725,"input_tokens":4435,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-63217':17A,20A '7.15.2':81C,158C '8.10.2':83C,160C 'access':43B,102C 'acl':12A,61B,141C 'acl-deni':11A 'affect':104C 'applic':78C 'arbitrari':90C 'attack':118C 'attacker-control':117C 'authent':46B,131C 'author':122C 'beanfactori':93C,113C 'begin':106C 'carri':116C 'check':38B,96C 'configur':140C 'contact':50B,144C 'control':119C 'crm':76C 'custom':55B,73C,149C 'custom-field':54B,148C 'cve':15A,18A 'data':57B,120C,151C 'deal':52B,146C 'deni':13A,63B,138C 'enterpris':71C 'enterprise-readi':70C 'entri':30B,86C 'field':56B,135C,150C 'financi':51B,145C 'fix':155C 'flow':105C 'generat':3A 'generatepdf':29B,85C,111C 'getbean':94C,114C 'host':25B 'id':36B 'includ':143C 'issu':153C 'let':4A 'load':32B,88C 'log':7A 'logged-in':6A 'manag':75C 'modules/aos_pdf_templates/generatepdf.php':108C 'open':68C 'open-sourc':67C 'oper':129C 'packag':21B 'pdf':2A 'php':22B 'point':31B,87C 'prior':79C 'read':10A,49B,134C 'readi':72C 'record':14A,34B,59B,91C,101C,137C 'relationship':74C 'request':40B,98C 'right':44B 'role':62B,142C 'secur':127C 'security-sensit':126C 'self':24B 'self-host':23B 'sensit':128C 'softwar':77C 'sourc':69C 'state':123C 'suitecrm':1A,26B,27B,64C 'use':110C 'user':9A,41B,47B,99C,132C 'version':157C 'without':37B,95C","nicknames":[],"mitigations":[],"who_affected":"Any SuiteCRM installation below 7.15.2 or 8.10.2 is exposed, to any user with a login, since the flaw is in the PDF template generation path. Installations where only trusted staff have accounts and records are not sensitive are lower risk. Hosted SaaS deployments are handled by the vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","php","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-07-31T14:40:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63217","severity":null,"published_at":"2026-11-05T19:17:23+00:00","modified_at":"2026-11-05T19:17:24+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","fetched_at":"2026-11-05T19:40:37+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79278,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-m5xj-rrwv-g3q3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-31T14:40:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}