Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-63217

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the generatePdf entry point loads an arbitrary record through BeanFactory::getBean() without checking the requesting user's record access. The affected flow begins at modules/AOS_PDF_Templates/generatePdf.php and uses generatePdf, and BeanFactory::getBean() to carry attacker-controlled data or authorization state into the security-sensitive operation. Any authenticated user can read fields from records denied by configured ACL roles, including contact, financial, deal, and custom-field data. This issue is fixed in versions 7.15.2 and 8.10.2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 23.4%
CVSS Severity
CVSS v3 Score 6.5
Products affected by CVE-2026-63217


Contact Us

Shodan ® - All rights reserved