SuiteCRM CVE-2026-108712

Requires a valid authenticated non-admin SuiteCRM account (PR:L); exploitation is not possible unauthenticated. The attacker invokes the DetailUserRole entry point and supplies a different non-admin user's identifier in the 'record' parameter - the specific prerequisite is simply having any logged-in user session plus knowledge or enumeration of another user's record id. No special non-default configuration, plugin, or user interaction is needed; it affects standard installations of SuiteCRM 7.15.2/8.10.2 and earlier. Limiting factors: impact is confined to disclosure of role assignments and the per-module ACL action matrix (confidentiality only, no data modification or service disruption), and the required authenticated foothold reduces exposure for internet-facing instances with restricted account provisioning.

This is a medium-severity information-disclosure issue, not a high-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 and is internally consistent with the description: network-reachable, low complexity, but requires low privileges (PR:L = an authenticated non-admin account) and yields only low confidentiality impact with zero integrity or availability impact. The mapping to CWE-862 (Missing Authorization) and the described IDOR-style abuse of the 'record' parameter are coherent. No EPSS score, CISA KEV listing, or confirmed proof-of-concept/exploit-code flag was provided in the input, so there is no public exploit identified at time of analysis - though a third-party technical write-up (hackmd) and direct source-line references are present, which lower the effort needed to reproduce. The signals are mutually consistent (no conflicts): a genuine but low-impact authorization gap that leaks other users' ACL/role configuration, useful mainly for reconnaissance toward privilege-mapping rather than direct compromise. Real-world priority is moderate and gated by the need for a valid non-admin login.

An authenticated low-privilege SuiteCRM user calls the DetailUserRole entry point and substitutes another non-admin user's identifier in the 'record' parameter, causing the application to return that victim's assigned roles and full per-module ACL action matrix. No public exploit code is identified, but a technical write-up describing the record-parameter manipulation is referenced, making reproduction straightforward. The network attack vector and low complexity mean any valid account can perform this with a single crafted request.