CVE-2026-32697: SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the RecordHandler::getRecord() method retrieves any record by module and ID without checking the current user's ACL view permission. The companion saveRecord() method correctly checks $bean->ACLAccess('save'), but getRecord() skips the equivalent ACLAccess('view') check. Version 8.9.3 patches the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32697?
CVE-2026-32697 is classified as a high severity vulnerability due to its potential to expose sensitive records to any authenticated user.
How do I fix CVE-2026-32697?
To fix CVE-2026-32697, upgrade SuiteCRM to version 8.9.3 or later where the vulnerability is patched.
What type of vulnerability is CVE-2026-32697?
CVE-2026-32697 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the RecordHandler component in SuiteCRM.
Who is affected by CVE-2026-32697?
Any authenticated user of SuiteCRM versions prior to 8.9.3 is affected by CVE-2026-32697 as they can access any record.
What component of SuiteCRM does CVE-2026-32697 affect?
CVE-2026-32697 affects the RecordHandler::getRecord() method in SuiteCRM, leading to unauthorized record access.