SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltration

Overview

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the generatePdf entry point loads an arbitrary record through BeanFactory::getBean() without checking the requesting user's record access. The affected flow begins at modules/AOS_PDF_Templates/generatePdf.php and uses generatePdf, and BeanFactory::getBean() to carry attacker-controlled data or authorization state into the security-sensitive operation. Any authenticated user can read fields from records denied by configured ACL roles, including contact, financial, deal, and custom-field data. This issue is fixed in versions 7.15.2 and 8.10.2.

Affected

• SuiteCRM < 7.15.2
• SuiteCRM >= 8.0.0, < 8.10.2

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.