CVE-2026-69144: SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a documentrevisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved and served without checking its parent document. A low-privileged authenticated user can use this identifier confusion to download administrator-owned or otherwise protected documents. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Which deployments are affected?
SuiteCRM versions before 7.15.2 and SuiteCRM 8 versions before 8.10.2 are affected. The vulnerable behavior is in download.php when a document revision UUID is supplied with type=Documents.
What access does an attacker need?
An attacker needs an authenticated low-privileged SuiteCRM account and a document revision UUID. No user interaction is required.
What data could be exposed?
A low-privileged user may download administrator-owned or otherwise protected documents because authorization is checked against an empty Documents bean rather than the revision's parent document.
What should be done to remediate the issue?
Upgrade SuiteCRM to version 7.15.2 or 8.10.2, depending on the deployed release line. These versions fix the authorization check for document revisions.