CVE-2026-61649High· 7.7▾ TwilightSuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the SSRF protection added in 7.15.1 uses a substring comparison in isSelfRequest() rather than hostname…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the SSRF protection added in 7.15.1 uses a substring comparison in isSelfRequest() rather than hostname equality. The affected flow begins at validate_external_host() and uses isSelfRequest(), and stripos() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated attacker can place the server hostname in a URL path to bypass IP validation and direct server-side requests to internal services. This issue is fixed in versions 7.15.2 and 8.10.2.
SuiteCRM < 7.15.2SuiteCRM >= 8.0.0, < 8.10.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69137High· 7.7SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure
CVE-2026-63111High· 7.1SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron
CVE-2026-97377High· 8.8SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
CVE-2026-63218Medium· 6.5SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage
CVE-2026-100360High· 7.1SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record
CVE-2026-69141High· 8.3SuiteCRM: SQL injection via search param in modules/Cases/controller.php