Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-63111— SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron

Quick assessment

Affected

SuiteCRM SuiteCRM

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SuiteCRM 是一款开源且面向企业级的客户关系管理（CRM）软件应用。在 7.15.2 和 8.10.2 版本之前，其 V8 模块 API 缺乏模块级授权机制，允许低权限用户创建包含攻击者可控目标值的 SchedulersJobs 记录。受影响的流程始于，并通过 SchedulersJobs、target、cron.php 以及将攻击者控制的数据或授权状态传入安全敏感操作。随后，cron.php 会以系统权限执行已排队的任务；而目标会触发服务器端向内部或外部主机的请求，支持跟随重定向，可配置为周期性重复执

CVSS 7.1 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 3 AI

T1071.001 · Web Protocols T1048.002 · Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1059.007 · JavaScript

Affected Version Matrix 2

Vendor	Product	Version Range	Status
SuiteCRM	SuiteCRM	`< 7.15.2`	affected
		`>= 8.0.0, < 8.10.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron

Source: CVE Program / CVE List V5

Vulnerability Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API lacks module-level authorization and permits a low-privileged user to create SchedulersJobs records with attacker-controlled target values. The affected flow begins at /Api/V8/module and uses SchedulersJobs, target, cron.php, and url:: to carry attacker-controlled data or authorization state into the security-sensitive operation. Cron.php later executes the queued job with system privileges, and the url:: target makes server-side requests to internal or external hosts, can follow redirects, can persist as a recurring job, and may expose internal services. This issue is fixed in versions 7.15.2 and 8.10.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
SuiteCRM	SuiteCRM	< 7.15.2	-

II. Public POCs for CVE-2026-63111

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63111

请登录查看更多情报信息。

Other References for CVE-2026-63111 (5)

https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2 x_refsource_MISC
https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2 x_refsource_MISC
https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-gx3x-3f4c-cjmx x_refsource_CONFIRM
https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c x_refsource_MISC
https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63111

Same Patch Batch · SuiteCRM · 2026-11-05 · 31 CVEs total

CVE-2026-71550	9.9 CRITICAL	SuiteCRM: LFI to RCE via AOW_WorkFlow
CVE-2026-100358	9.4 CRITICAL	SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection
CVE-2026-69134	8.8 HIGH	SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management
CVE-2026-69142	8.8 HIGH	SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter
CVE-2026-97377	8.8 HIGH	SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
CVE-2026-71548	8.8 HIGH	SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field)
CVE-2026-100365	8.8 HIGH	SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfil
CVE-2026-100363	8.8 HIGH	SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)
CVE-2026-63214	8.8 HIGH	SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api
CVE-2026-61651	8.3 HIGH	SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller
CVE-2026-69140	8.3 HIGH	SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php
CVE-2026-69141	8.3 HIGH	SuiteCRM: SQL injection via search param in modules/Cases/controller.php
CVE-2026-63215	8.3 HIGH	SuiteCRM: Time-Based Blind SQL Injection via REST API
CVE-2026-61648	8.3 HIGH	SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.php
CVE-2026-61653	8.3 HIGH	SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php
CVE-2026-61650	8.1 HIGH	SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorizat
CVE-2026-61649	7.7 HIGH	SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services
CVE-2026-69137	7.7 HIGH	SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Acc
CVE-2026-63213	7.2 HIGH	SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') i
CVE-2026-100361	7.1 HIGH	SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_has

Showing top 20 of 31 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: SuiteCRM

Same vendor: SuiteCRM

Same weakness: CWE-862