PT-2025-32230 · Suitecrm · Suitecrm

Sec31Uk · Published 2025-08-06 · Updated 2025-08-18 · CVE-2025-54786

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.14.6 and 8.8.0

Description SuiteCRM, an open-source Customer Relationship Management (CRM) software application, suffers from broken authentication within the legacy iCal service. This allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, and related functionality enables user enumeration.

Recommendations Update to SuiteCRM version 7.14.7. Update to SuiteCRM version 8.8.1.

Exploit

Fix

Improper Access Control

Improper Authentication

Information Disclosure

Weakness Enumeration

CWE-284

CWE-287

CWE-200

Related Identifiers

BIT-SUITECRM-2025-54786

CVE-2025-54786

GHSA-RF2V-4MV3-QCGM

Affected Products

Suitecrm

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54786.json · Exploit
• https://osv.dev/vulnerability/BIT-suitecrm-2025-54786 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54786 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54786 · Security Note
• https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-rf2v-4mv3-qcgm · Note
• https://t.me/cveNotify/132347 · Telegram Post
• https://docs.suitecrm.com/8.x/admin/releases/8.8 · Note
• https://twitter.com/CVEnew/status/1953238837985198095 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1953337032828207324 · Twitter Post
• https://t.me/CVEtracker/29405 · Telegram Post