What is the CVSS score of CVE-2026-32697?

CVE-2026-32697 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Suitecrm are affected by CVE-2026-32697?

Organizations using SuiteCRM should be aware of notable risk from CVE-2026-32697, a IDOR vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-32697?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Suitecrm CVE-2026-32697

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-20 security-advisories@github.com

Authentication Bypass Suitecrm

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 00:30 vuln.today

CVE Published

Mar 20, 2026 - 00:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the RecordHandler::getRecord() method retrieves any record by module and ID without checking the current user's ACL view permission. The companion saveRecord() method correctly checks $bean->ACLAccess('save'), but getRecord() skips the equivalent ACLAccess('view') check. Version 8.9.3 patches the issue.

AnalysisAI

SuiteCRM versions prior to 8.9.3 contain an access control bypass in the RecordHandler::getRecord() method that allows authenticated users to retrieve any record from the system without proper ACL view permission checks. An attacker with valid credentials can enumerate and read sensitive customer data, financial records, or other confidential information across all modules by directly calling the vulnerable method. The vulnerability has a CVSS score of 6.5 (medium-high) and is information disclosure in nature with no active exploitation reports or public proof-of-concept available at this time.

Technical ContextAI

The vulnerability exists in SuiteCRM's record retrieval logic, which is part of the enterprise CRM application's access control framework. The RecordHandler class is responsible for database operations across various CRM modules (Contacts, Accounts, Opportunities, etc.). CWE-639 (Authorization Bypass Through User-Controlled Key) identifies the root cause: the getRecord() method fails to validate user permissions via the $bean->ACLAccess('view') check, unlike its counterpart saveRecord() which correctly implements $bean->ACLAccess('save'). This inconsistency in permission enforcement across similar methods represents a logic flaw in the authorization layer. The affected technology stack includes PHP-based CRM middleware with a custom ACL (Access Control List) system that relies on explicit permission validation at the method level rather than enforced at the database query layer.

RemediationAI

Immediately upgrade SuiteCRM to version 8.9.3 or later, which includes the ACL permission check fix in the RecordHandler::getRecord() method. Follow the vendor's standard upgrade procedure available in the SuiteCRM documentation and the GitHub Security Advisory at https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-9p9g-224x-6rmm. As an interim mitigation before patching is possible, implement network-level access controls to restrict SuiteCRM access to trusted IP ranges, enforce strong authentication mechanisms (multi-factor authentication for all user accounts), monitor database query logs for anomalous bulk record retrieval patterns, and conduct an audit of user account activity logs to identify any unauthorized data access. Additionally, review and tighten ACL configurations to apply the principle of least privilege, ensuring users have access only to the modules and records necessary for their roles.