CVE-2025-64489: SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account deactivation. An inactive user with an active session can continue to access the application and, critically, can self-reactivate their account. This undermines administrative controls and allows unauthorized persistence. This issue is fixed in versions 7.14.8 and 8.9.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64489?
CVE-2025-64489 has been classified as a privilege escalation vulnerability.
How do I fix CVE-2025-64489?
To fix CVE-2025-64489, upgrade SuiteCRM to version 7.14.8 or later, or ensure you are using a version outside the vulnerable 8.0.0-beta.1 to 8.9.0 range.
What versions of SuiteCRM are affected by CVE-2025-64489?
CVE-2025-64489 affects SuiteCRM versions 7.14.7 and prior, and 8.0.0-beta.1 through 8.9.0.
What is the impact of CVE-2025-64489 on SuiteCRM users?
The impact of CVE-2025-64489 is that user sessions may remain active even after an account is deactivated, which could lead to unauthorized access.
Is there a known exploit for CVE-2025-64489?
As of now, there is no publicly known exploit specifically targeting CVE-2025-64489.