What is the CVSS score of CVE-2026-29108?

CVE-2026-29108 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Suitecrm are affected by CVE-2026-29108?

Organizations using SuiteCRM should be aware of notable risk from CVE-2026-29108, a information exposure vulnerability rated CVSS 6.5. Sensitive information could be exposed to unauthorized parties.

How to fix or mitigate CVE-2026-29108?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Suitecrm CVE-2026-29108

MEDIUM

Information Exposure (CWE-200)

2026-03-20 security-advisories@github.com

Information Disclosure Suitecrm

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 00:30 vuln.today

CVE Published

Mar 20, 2026 - 00:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, an authenticated API endpoint allows any user to retrieve detailed information about any other user, including their password hash, username, and MFA configuration. As any authenticated user can query this endpoint, it's possible to retrieve and potentially crack the passwords of administrative users. Version 8.9.3 patches the issue.

AnalysisAI

SuiteCRM prior to version 8.9.3 contains an authenticated information disclosure vulnerability in an API endpoint that allows any authenticated user to retrieve sensitive user data including password hashes, usernames, and MFA configurations of other users. This enables attackers with valid credentials to enumerate and potentially crack administrative user passwords, escalating privileges within the CRM system. The vulnerability requires authentication but no additional user interaction, making it a practical attack vector for insider threats or compromised low-privilege accounts.

Technical ContextAI

SuiteCRM is an open-source enterprise CRM application built on PHP and relational database technologies. The vulnerability exists in an authenticated REST API endpoint that fails to implement proper authorization controls, violating the principle of least privilege. This is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a root cause category that indicates insufficient access control checks on sensitive data endpoints. The API endpoint does not validate whether the requesting user has permission to access user profile data beyond confirming authentication status, allowing lateral enumeration of user accounts and credential material across the system regardless of the requester's role or organizational scope.

RemediationAI

Immediately upgrade SuiteCRM to version 8.9.3 or later, which patches the authorization bypass in the affected API endpoint. Organizations unable to patch immediately should implement network-level access controls restricting API endpoint access to trusted administrative networks only, enforce strong authentication mechanisms including multi-factor authentication for all user accounts to limit damage from compromised credentials, and conduct a security audit to identify whether low-privilege user accounts have been created or compromised. Review API access logs for enumeration attempts and audit user password hashes for evidence of cracking attempts. The official security advisory at https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-xc8w-xc9v-45w5 contains additional remediation and detection guidance from the SuiteCRM security team.