CVE-2025-54786: SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54786?
CVE-2025-54786 is considered a high severity vulnerability due to its potential for unauthenticated access to sensitive meeting data.
How do I fix CVE-2025-54786?
To fix CVE-2025-54786, update your SuiteCRM installation to version 8.8.1 or later.
Which versions of SuiteCRM are affected by CVE-2025-54786?
CVE-2025-54786 affects SuiteCRM versions 7.14.6 and 8.8.0.
What kind of access does CVE-2025-54786 allow?
CVE-2025-54786 allows unauthenticated actors to view any user's meeting data through the legacy iCal service.
Is there a workaround for CVE-2025-54786?
Currently, the best course of action for CVE-2025-54786 is to update to a patched version, as no effective workaround is recommended.