SuiteCRM EUVD-2026-96987

Requires a valid authenticated SuiteCRM session for a low-privileged user - specifically one whose role denies Campaigns module access (PR:L) - who can reach the setCampaignMarketingAndTemplate entry point and POST marketingId, campaignId, and templateId values. No user interaction and no elevated privileges are needed, and impact only materializes where campaigns and EmailMan-driven campaign emails are actually in use. Limiting factors: exploitation is impossible for fully unauthenticated attackers (an account is required), impact is confined to tampering with campaign marketing messages/templates (low integrity, no data disclosure or outage), and it affects SuiteCRM through 7.15.2 and 8.x through 8.10.2.

This is a genuine but moderate-priority issue, not a high-CVSS scare. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) scores 5.3 (medium) and is internally consistent with the description: network-reachable, low attack complexity, but requiring an authenticated low-privileged account (PR:L) and yielding only low integrity impact (VI:L) with no confidentiality or availability impact. The core risk is a broken-access-control / missing-authorization flaw (CWE-862): a user explicitly denied Campaigns access can still manipulate EmailMarketing records through the setCampaignMarketingAndTemplate entry point. No EPSS score, CISA KEV listing, or POC flag was supplied in the input, so there is no public evidence of active exploitation or automated weaponization - the risk is manual, requires insider/low-priv access, and is limited to tampering with outbound campaign email content rather than full data theft or system compromise. A technical writeup is referenced (hackmd) but is not marked as a weaponized exploit. Note a minor signal tension: the input Tag 'Authentication Bypass' overstates the issue - the attacker is already authenticated, so this is authorization bypass, not authentication bypass; treat 'authentication bypass' claims about this CVE with caution.

A low-privileged SuiteCRM user who has been explicitly denied access to the Campaigns module authenticates normally, then POSTs crafted marketingId, campaignId, and templateId parameters to the setCampaignMarketingAndTemplate entry point. Because the endpoint omits an authorization check, the user reattaches marketing messages or swaps the template that EmailMan subsequently sends in campaign emails, enabling content tampering (e.g., inserting malicious links or misleading messaging) into outbound campaigns. A technical writeup describing the flaw is publicly referenced, though no weaponized exploit is confirmed in the input.