PT-2025-45498 · Suitecrm · Suitecrm

Published 2025-11-04 · Updated 2025-11-13 · CVE-2025-64489

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.14.7 and prior SuiteCRM versions 8.0.0 through 8.9.0

Description SuiteCRM is a Customer Relationship Management (CRM) software application. A flaw exists where user sessions are not invalidated when an account is deactivated. A user with a deactivated account and an active session can continue to access the application and reactivate their account, bypassing administrative controls and allowing unauthorized persistence.

Recommendations Update to SuiteCRM version 7.14.8 or later. Update to SuiteCRM version 8.9.1 or later.

Exploit

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2025-13973

CVE-2025-64489

GHSA-J6JG-9JJ3-Q2PH

Affected Products

Suitecrm

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64489.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/commit/40da2845a170832a4e9e9fa0ebe731f8c34de42d · Patch
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-j6jg-9jj3-q2ph · Vendor Advisory
• https://github.com/SuiteCRM/SuiteCRM-Core/commit/30277cfe69755f7360a23d4805e06a5c38f14131 · Patch
• https://osv.dev/vulnerability/CVE-2025-64489 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13973 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-64489 · Security Note
• https://t.me/CVEtracker/36833 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1987015568478622199 · Twitter Post
• https://twitter.com/marcfredericgo/status/1987644010513752126 · Twitter Post
• https://t.me/cveNotify/142185 · Telegram Post
• https://twitter.com/CveTodo/status/1986968979592593759 · Twitter Post
• https://twitter.com/prakhar0x01/status/1986854832897147146 · Twitter Post
• https://twitter.com/cracbot/status/1988924851529347317 · Twitter Post