BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-69144SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved and served without checking its parent document. A low-privileged authenticated user can use this identifier confusion to download administrator-owned or otherwise protected documents. This issue is fixed in versions 7.15.2 and 8.10.2.

6.5 MEDIUMEPSS 0.31%Not in KEVNVD: Undergoing Analysis

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
6.5MEDIUM3.1GitHub_M (CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CVE ID
CVE-2026-69144
Status
Undergoing Analysis
Assigner (CNA)
GitHub_M
Published
Nov 5, 2026
Last modified
2026-11-05 19:17 UTC
Weaknesses
  • CWE-639 · Authorization Bypass Through User-Controlled Key
  • CWE-863 · Incorrect Authorization

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:24 UTC.