CVE-2026-61649: SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the SSRF protection added in 7.15.1 uses a substring comparison in isSelfRequest() rather than hostname equality. The affected flow begins at validateexternalhost() and uses isSelfRequest(), and stripos() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated attacker can place the server hostname in a URL path to bypass IP validation and direct server-side requests to internal services. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Which deployments are affected?
SuiteCRM versions earlier than 7.15.2 and 8.10.2 are affected. The issue is fixed in SuiteCRM 7.15.2 and 8.10.2.
What access does an attacker need to exploit this issue?
An attacker must be authenticated to SuiteCRM. No user interaction is required, and the attack can be initiated over the network.
How does the SSRF protection bypass work?
The affected isSelfRequest() logic uses a substring comparison rather than an exact hostname comparison. An authenticated attacker can include the server hostname in a URL path, bypass IP validation, and cause SuiteCRM to send requests to internal services.
What should be done if an affected version is in use?
Upgrade to SuiteCRM 7.15.2 or 8.10.2. The provided data does not identify a configuration workaround or other mitigation for systems that cannot be patched immediately.