{"id":"CVE-2026-69144","kind":"vulnerability","aliases":["CVE-2026-69144"],"related":[],"title":"SuiteCRM: low-privilege users can download protected documents via revision IDs","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved and served without checking its parent document. A low-privileged authenticated user can use this identifier confusion to download administrator-owned or otherwise protected documents. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's download.php checks permissions against the wrong record when a document revision ID is submitted, so the revision is served without checking its parent document. A logged-in low-privileged user can download administrator-owned or otherwise protected documents.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","package","self-hosted","suitecrm"],"not_affected_if":["managed-hosting","no-low-privilege-users","patched-version"],"how_to_check":"- Check the installed SuiteCRM version: `7.15.2` or `8.10.2` and later are fixed; anything earlier on those branches is affected.\n- Review whether document downloads are available to non-admin user accounts in your instance.","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:17:25+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","triaged_at":"2026-11-05T19:43:19+00:00","updated_at":"2026-11-05T19:43:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T19:43:19Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"network","title":"SuiteCRM: low-privilege users can download protected documents via revision IDs","impact":"medium","summary":"SuiteCRM's download.php checks permissions against the wrong record when a document revision ID is submitted, so the revision is served without checking its parent document. A logged-in low-privileged user can download administrator-owned or otherwise protected documents.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","crm"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated low-privilege user downloads protected documents owned by administrators","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version: `7.15.2` or `8.10.2` and later are fixed; anything earlier on those branches is affected.\n- Review whether document downloads are available to non-admin user accounts in your instance.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-low-privilege-users","managed-hosting"],"who_is_affected":"Any SuiteCRM instance running a version before 7.15.2 or 8.10.2 where users have accounts with low privileges can be affected, since the attacker needs a logged-in account. Instances that use only administrators or disable document access for ordinary users have less exposure. The sources do not say whether managed hosting providers have already applied the fix.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4399,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-69144':15A,18A '7.15.2':85C,158C '8.10.2':87C,160C 'administr':62B,146C 'administrator-own':61B,145C 'applic':82C 'authent':136C 'author':90C 'bean':94C,119C 'check':28B,47B,89C,114C,128C 'confus':142C 'crm':19B,80C 'custom':77C 'cve':13A,16A 'document':9A,36B,50B,67B,93C,112C,118C,131C,151C 'document_revisions.id':103C 'download':7A,60B,144C 'download.php':27B,88C 'empti':117C 'enterpris':75C 'enterprise-readi':74C 'fix':155C 'host':23B 'id':12A,38B 'identifi':100C,141C 'issu':153C 'log':53B 'logged-in':52B 'low':3A,56B,134C 'low-privileg':2A,55B,133C 'manag':79C 'open':72C 'open-sourc':71C 'otherwis':65B,149C 'own':63B,147C 'packag':20B 'parent':49B,130C 'permiss':29B 'prior':83C 'privileg':4A,57B,135C 'protect':8A,66B,150C 'readi':76C 'record':33B 'relationship':78C 'resolv':96C,124C 'revis':11A,37B,43B,106C,121C 'self':22B 'self-host':21B 'serv':45B,126C 'softwar':81C 'sourc':73C 'submit':40B,109C 'suitecrm':1A,24B,25B,68C 'suppli':99C 'target':115C 'type':111C 'use':139C 'user':5A,58B,137C 'uuid':107C 'version':157C 'via':10A 'whether':97C 'without':46B,127C 'wrong':32B","nicknames":[],"mitigations":[],"who_affected":"Any SuiteCRM instance running a version before 7.15.2 or 8.10.2 where users have accounts with low privileges can be affected, since the attacker needs a logged-in account. Instances that use only administrators or disable document access for ordinary users have less exposure. The sources do not say whether managed hosting providers have already applied the fix.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crm","medium","package","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-08-05T11:44:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-69144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69144","severity":null,"published_at":"2026-11-05T19:17:25+00:00","modified_at":"2026-11-05T19:17:25+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","fetched_at":"2026-11-05T19:40:38+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79323,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-j2r4-r4wh-339v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-05T11:44:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}