PT-2026-26446 · Suitecrm · Suitecrm

Jbince · Publicado 2026-03-19 · Atualizado 2026-03-20 · CVE-2026-29108

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 8.9.3

Description SuiteCRM is a customer relationship management software application. An authenticated API endpoint allows any user to retrieve detailed information about any other user, including their password hash, username, and multi-factor authentication (MFA) configuration. Because any authenticated user can query this endpoint, it is possible to retrieve and potentially crack the passwords of administrative users. The vulnerable API endpoint allows unauthorized access to sensitive user data.

Recommendations Update to version 8.9.3 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-29108

GHSA-XC8W-XC9V-45W5

Produtos afetados

Suitecrm

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29108.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-xc8w-xc9v-45w5 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-29108 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034841501059174811 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-29108 · Nota de Segurança