CVE-2026-69144 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's download.php checks permissions against the wrong record when a document revision ID is submitted, so the revision is served without checking its parent document. A logged-in low-privileged user can download administrator-owned or otherwise protected documents.
first public Aug 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any SuiteCRM instance running a version before 7.15.2 or 8.10.2 where users have accounts with low privileges can be affected, since the attacker needs a logged-in account. Instances that use only administrators or disable document access for ordinary users have less exposure. The sources do not say whether managed hosting providers have already applied the fix.
Not affected if managed-hosting, no-low-privilege-users, patched-version
Who cares crm, self-hosted, suitecrm
7.15.2 or 8.10.2 and later are fixed; anything earlier on those branches is affected.7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved and served without checking its parent document. A low-privileged authenticated user can use this identifier confusion to download administrator-owned or otherwise protected documents. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.