PT-2025-45499 · Suitecrm · Suitecrm

Published 2025-11-06 · Updated 2025-11-13 · CVE-2025-64490

Positive Technologies (AI Summary)

CVSS v2.0

8.7

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.14.7 and prior SuiteCRM versions 8.0.0-beta.1 through 8.9.0

Description SuiteCRM is a Customer Relationship Management (CRM) software application. Low-privileged users with restrictive roles can view and create work items through the Resource Calendar and project screens, even when related modules are disabled or set to 'None' in Role Management. This is due to inconsistent Access Control List (ACL) and Role-Based Access Control (RBAC) enforcement. This can lead to unauthorized data exposure and modification.

Recommendations Update to SuiteCRM version 7.14.8 or later. Update to SuiteCRM version 8.9.1 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-13974

CVE-2025-64490

GHSA-JH8V-WQGJ-HHC2

Affected Products

Suitecrm

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64490.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-jh8v-wqgj-hhc2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64490 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64490 · Security Note
• https://bdu.fstec.ru/vul/2025-13974 · Security Note
• https://twitter.com/CveTodo/status/1986969479302058466 · Twitter Post
• https://twitter.com/cracbot/status/1988924853307732060 · Twitter Post
• https://twitter.com/prakhar0x01/status/1986854832897147146 · Twitter Post
• https://twitter.com/marcfredericgo/status/1987644010513752126 · Twitter Post
• https://t.me/cveNotify/142186 · Telegram Post
• https://t.me/CVEtracker/36834 · Telegram Post