What is the CVSS score of CVE-2026-29189?

CVE-2026-29189 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Suitecrm are affected by CVE-2026-29189?

SuiteCRM instances are vulnerable to unauthorized data access and manipulation through REST API endpoints due to missing access controls.

How to fix or mitigate CVE-2026-29189?

Within 24 hours: Inventory all SuiteCRM deployments and versions; audit API access logs for suspicious activity. Within 7 days: Implement network segmentation to restrict API endpoint access to authorized applications only; disable REST API V8 if not actively used. Within 30 days: Monitor vendor release channels closely for patches to versions 7.15.1 and 8.9.3; plan and execute immediate patching upon availability.

Suitecrm CVE-2026-29189

HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-20 security-advisories@github.com

Authentication Bypass Suitecrm

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 00:30 vuln.today

CVE Published

Mar 20, 2026 - 00:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL (Access Control List) checks on several endpoints, allowing authenticated users to access and manipulate data they should not have permission to interact with. Versions 7.15.1 and 8.9.3 patch the issue.

AnalysisAI

A critical access control vulnerability exists in the SuiteCRM REST API V8 where multiple endpoints lack proper ACL (Access Control List) validation, enabling authenticated users to access and modify data beyond their authorized permissions. This affects SuiteCRM versions prior to 7.15.1 and 8.9.3, allowing privilege escalation within the CRM system where low-privileged users can potentially access sensitive customer data, modify records, or perform administrative actions. With a CVSS score of 8.1 and authentication bypass capabilities, this represents a significant security risk for organizations using affected versions.

Technical ContextAI

SuiteCRM is an open-source Customer Relationship Management platform that provides REST API endpoints for programmatic access to CRM functionality. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the REST API V8 implementation fails to properly enforce access control checks on several endpoints, allowing authenticated users to manipulate API requests to access resources they shouldn't have permissions for. This type of vulnerability is particularly dangerous in multi-tenant or multi-user CRM environments where data isolation between users and departments is critical for maintaining confidentiality and data integrity.

RemediationAI

Immediately upgrade SuiteCRM to version 7.15.1 or later for 7.x deployments, or to version 8.9.3 or later for 8.x deployments, as these versions contain the security patches addressing the missing ACL checks. Until patching is complete, consider implementing additional access controls at the network level such as IP whitelisting for API access, enabling comprehensive API logging and monitoring for unauthorized data access attempts, and reviewing user permissions to ensure principle of least privilege. Consult the vendor security advisory at https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-m6x8-3hxp-qxwv for additional details.