PT-2026-26449 · Suitecrm · Suitecrm-Core

Published 2026-03-19 · Updated 2026-03-20 · CVE-2026-32697

Mitre

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the RecordHandler::getRecord() method retrieves any record by module and ID without checking the current user's ACL view permission. The companion saveRecord() method correctly checks $bean->ACLAccess('save'), but getRecord() skips the equivalent ACLAccess('view') check. Version 8.9.3 patches the issue.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-32697

Affected Products

Suitecrm-Core

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-32697 · Security Note
• https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-9p9g-224x-6rmm · Note