CVE-2026-108712— SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point
Quick assessment
Affected
SuiteCRM SuiteCRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SuiteCRM 7.15.2 及以下版本以及 8.10.2 版本中存在一个缺失授权检查的安全漏洞，该漏洞位于 DetailUserRole 入口点。此漏洞允许已认证的非管理员用户查看其他用户的 ACL（访问控制列表）数据。攻击者可以通过在 record 参数中提供另一个非管理员用户的 ID，读取该用户被分配的角色以及各模块的 ACL 操作矩阵。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108712
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point
Source: CVE Program / CVE List V5
Vulnerability Description
SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles and per-module ACL action matrix.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-108712
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108712
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-108712 (3)
-
-
-
🔗 SuiteCRM/modules/ACLRoles/DetailUserRole.php at v7.15.2 · SuiteCRM/SuiteCRM · GitHub technical-description
Vendor Advisories for CVE-2026-108712 (1)
Security Blog Posts for CVE-2026-108712 (1)
Other References for CVE-2026-108712 (1)
IV. Related Vulnerabilities
Same product: SuiteCRM
-
CVE-2026-108713
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via -
CVE-2019-25664
SuiteCRM 7.10.7 SQL Injection via record Parameter -
CVE-2019-25663
SuiteCRM 7.10.7 SQL Injection via parentTab Parameter -
CVE-2026-33289
SuiterCRM has LDAP Filter Injection in Authentication Module -
CVE-2026-33288
SuiteCRM has Authenticated SQL Injection in Authentication M
Same vendor: SuiteCRM
-
CVE-2026-108713
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via -
CVE-2019-25664
SuiteCRM 7.10.7 SQL Injection via record Parameter -
CVE-2019-25663
SuiteCRM 7.10.7 SQL Injection via parentTab Parameter -
CVE-2026-32697
SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view -
CVE-2026-29109
SuiteCRM Authenticated Remote Code Execution via Unsafe Dese
Same weakness: CWE-862
-
CVE-2026-106176
FortiSIEM 7.5.0授权缺失漏洞 -
CVE-2026-110131
ThriveX-Server through 4.0 Missing Authorization via Article -
CVE-2026-110123
Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization -
CVE-2026-110117
SmartAdmin through 3.30.0 Missing Authorization via AdminPro -
CVE-2026-110109
JetLinks Community through 2.10.0 Missing Authorization via
V. Comments for CVE-2026-108712
No comments yet