SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 20, 2026 · NIST NVD

   Detected

   SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL (Access Control List) checks on several endpoints, allowing authenticated users to access and manipulate data they should not have permission to interact with. Versions 7.15.1 and 8.9.3 patch the issue.

2. Jun 17, 2026 · NIST NVD

   Updated

   SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL (Access Control List) checks on several endpoints, allowing authenticated users to access and manipulate data they should not have permission to interact with. Versions 7.15.1 and 8.9.3 patch the issue.

Affected

• cpe suitecrm/suitecrmversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-29189

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-29189

  SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL (Access Control List) checks on several endpoints, allowing authenticated users to access and man

  nvd.nist.gov

References

• Release Notes · docs.suitecrm.com
• Vendor Advisory · github.com