Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved and served without checking its parent document. A low-privileged authenticated user can use this identifier confusion to download administrator-owned or otherwise protected documents. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T19:17:25.830Z",
  "pubdate": "2026-11-05T19:17:25.830Z",
  "executiveSummary": "SuiteCRM versions prior to 7.15.2 and 8.10.2 contain a critical authorization bypass vulnerability within the download.php component. The flaw arises from an identifier confusion vulnerability where the application fails to correctly validate the parent Document relationship when retrieving document_revisions. This allows a low-privileged authenticated user to bypass access control mechanisms and download sensitive, restricted, or administrator-owned documents.\nThe vulnerability represents a significant security risk, as it permits unauthorized data exfiltration of internal files without requiring elevated privileges. Attackers only need a valid user account to exploit the system. The impact involves a direct breach of confidentiality, as protected business documentation, sensitive client information, or internal records stored within the CRM can be retrieved by unauthorized actors. Organizations utilizing affected versions are at immediate risk of information leakage, and patching is required to enforce strict object-level authorization checks during the document retrieval process.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of authorization checks within the download.php file, which serves as the entry point for file retrieval requests. The system logic performs a security check against a Documents bean; however, it incorrectly maps the supplied identifier when the request type is set to 'Documents'. Specifically, when a revision UUID is submitted in conjunction with type=Documents, the application instantiates an empty Documents bean for the authorization check, rather than verifying the actual parent document associated with the revision.\nThe attack flow begins when an authenticated user crafts a request to download.php. By manipulating the request parameters—specifically providing a legitimate revision UUID while masquerading the type as 'Documents'—the attacker exploits the flaw in the validation logic. Because the application checks permissions against an empty bean, the authorization check returns a permissive result. Following this faulty check, the application proceeds to resolve the provided UUID against the document_revisions table. Since the permission validation has already been bypassed, the system retrieves and serves the file corresponding to the revision ID, regardless of the actual access control lists (ACLs) or ownership permissions attached to the parent Document.\nThis vulnerability is classified as an authorization bypass via identifier confusion. The component involved is the file download handler (download.php) within the SuiteCRM framework. Exploitation requires an authenticated session, but the user is not required to possess specific administrative or high-level privileges, effectively allowing horizontal or vertical privilege escalation concerning data access.\nSuccessful exploitation allows an attacker to iterate through revision UUIDs or identify specific targets to exfiltrate private files. Post-exploitation, the impact is strictly limited to unauthorized read access; however, the potential for sensitive data exposure is high. The flaw persists in all versions of SuiteCRM earlier than 7.15.2 and 8.10.2. The security logic fails to enforce a binding relationship check between the revision being requested and the access rights assigned to the parent document container, leading to the unauthorized disclosure of protected assets."
}