Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-29189: SuiteCRM API lets logged-in users view or change others’ data

CVE-2026-29189 · published 7 months ago

Summary

The SuiteCRM web service that lets programs talk to the system does not properly check who is allowed to see or edit certain information. Because of this, a user who can log in could look at or change other users’ preferences and linked records without permission. Upgrade to SuiteCRM version 7.15.1 or later (or 8.9.3 or later) to fix the problem.

Original advisory text

SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL (Access Control List) checks on several endpoints, allowing authenticated users to access and manipulate data they should not have permission to interact with. Versions 7.15.1 and 8.9.3 patch the issue.

References

https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-m6x8-3hxp-qxwv Vendor Advisory
https://docs.suitecrm.com/admin/releases/7.15.x URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29189... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-29189 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-639Authorization Bypass Through User-Controlled Key

Timeline

Published19 Mar 2026

Updated4 Nov 2026

First seen20 Mar 2026

Sources

CVE-2026-29189 · NVD

CVE-2026-29189 · OSV

GHSA-m6x8-3hxp-qxwv · GHSA

Track software like this

Free during beta