CVE-2026-69137: SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's serverurl directly to curl without host, address, or scheme validation. The affected flow begins at CalendarAccount::actiontestConnection and uses serverurl, CalDAVProvider::makeCalDAVRequest(), and PROPFIND to carry attacker-controlled data or authorization state into the security-sensitive operation. The server sends a PROPFIND request from its network context and returns non-success response bodies, enabling internal-service access, partial response disclosure, service enumeration, and possible cloud metadata access. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SuiteCRM user who can invoke the CalendarAccount testConnection action can supply a server_url that the application requests from the SuiteCRM server's network context. No user interaction is required.
What can an attacker access through the vulnerable request?
The attacker can cause the server to send PROPFIND requests to internal services or other attacker-selected endpoints. The issue can enable internal-service enumeration, partial disclosure of non-success response bodies, and possible access to cloud metadata services.
Are default deployments affected?
The available information does not identify any configuration prerequisite beyond the presence of the vulnerable CalendarAccount testConnection flow and an authenticated caller. The vulnerable code does not validate the URL host, address, or scheme.
Which versions contain the fix?
The issue is fixed in SuiteCRM 7.15.2 and 8.10.2. Versions before 7.15.2 and before 8.10.2 are affected.