Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the record-level access check enforced by DetailView. The affected flow begins at AOR_Reports and uses changeReportPage, and DetailView to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can directly invoke the action and read report rows and restricted-module data despite owner-only or role-based report visibility. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T19:17:24.173Z",
  "pubdate": "2026-11-05T19:17:24.173Z",
  "executiveSummary": "SuiteCRM versions prior to 7.15.2 and 8.10.2 are susceptible to an improper access control vulnerability within the AOR_Reports module. This security flaw manifests as a failure to enforce mandatory record-level access checks when invoking the changeReportPage controller action. Consequently, an authenticated attacker can bypass standard security restrictions—such as owner-only visibility or role-based access control—to view sensitive report data and underlying restricted-module information.\nThe vulnerability represents a significant risk to data confidentiality, as it allows unauthorized users to perform information disclosure attacks by accessing records that should otherwise be protected. Exploitation requires the attacker to be an authenticated user within the application, but it does not necessitate administrative privileges. Successful exploitation facilitates the exfiltration of sensitive business data, potentially leading to unauthorized data exposure across the CRM platform.",
  "technicalDetails": "The vulnerability is rooted in an authorization bypass within the AOR_Reports component of SuiteCRM. Specifically, the changeReportPage controller action is designed to handle report rendering operations but fails to replicate the comprehensive security validation logic integrated into the DetailView framework. In a secure implementation, the DetailView controller enforces record-level access control (RLAC) to ensure that users can only view data based on their assigned roles, ownership status, or explicit permissions.\nThe attack flow begins when an authenticated user crafts a specific request to the changeReportPage action. Because this function bypasses the application’s standard access check infrastructure, the underlying system treats the request as legitimate, even if the user lacks the necessary authorization to view the requested report or the records contained within it. The vulnerability is triggered because the application flow transitions from the AOR_Reports logic to the rendering phase without verifying the security-sensitive authorization state enforced elsewhere in the CRM ecosystem.\nThe technical impact involves an unauthorized traversal of the report generation process. By directly invoking the changeReportPage action, the attacker forces the system to process and display report rows that are restricted to higher-privileged users or specific data owners. This bypass effectively ignores the security filters that normally sanitize output based on the user's authorization context. As a result, the application yields data that the current user context is explicitly restricted from accessing.\nAffected versions include all instances of SuiteCRM prior to 7.15.2 and 8.10.2. The exploitation requires the attacker to have an active, authenticated session within the SuiteCRM environment. While remote network access is required, the primary constraint is the lack of authorization validation rather than the exposure of the endpoint itself. No advanced administrative privileges are required to weaponize this flaw, making it a highly accessible vector for malicious actors seeking to gain unauthorized insight into private report data and associated restricted modules."
}