CVE-2026-63218 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's changeReportPage action renders a protected report without the record-level access check that DetailView enforces. An authenticated user can read report rows and restricted-module data they should not see.
first public Jul 31, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any SuiteCRM instance running a version before 7.15.2 or 8.10.2 that uses AOR reports with owner-only or role-based visibility. An attacker needs a valid logged-in account, and any authenticated user can reach the affected action directly. Instances on the fixed versions are not affected.
Not affected if no-restricted-reports, patched-version
Who cares crm, self-hosted, suitecrm
config.php, and compare it with the fixed versions below.7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the record-level access check enforced by DetailView. The affected flow begins at AOR_Reports and uses changeReportPage, and DetailView to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can directly invoke the action and read report rows and restricted-module data despite owner-only or role-based report visibility. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.