CVE-2026-29189: SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL (Access Control List) checks on several endpoints, allowing authenticated users to access and manipulate data they should not have permission to interact with. Versions 7.15.1 and 8.9.3 patch the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29189?
The severity of CVE-2026-29189 is classified as a medium risk due to the potential for unauthorized access to user preferences.
How do I fix CVE-2026-29189?
To fix CVE-2026-29189, upgrade SuiteCRM to versions 7.15.1 or 8.9.3 or later.
What are the affected versions of SuiteCRM for CVE-2026-29189?
The affected versions for CVE-2026-29189 include SuiteCRM prior to versions 7.15.1 and 8.9.3.
What type of vulnerability is CVE-2026-29189?
CVE-2026-29189 is an Insecure Direct Object Reference (IDOR) vulnerability related to missing ACL checks.
How does CVE-2026-29189 impact user data in SuiteCRM?
CVE-2026-29189 can potentially allow unauthorized users to access or modify user preferences, impacting data confidentiality.