SuiteCRM security vulnerabilities
CMS / eCommerce / ERP. Public CVE monitoring for SuiteCRM. Vendor security advisories are linked on this page.
Built for Operators of this product.
56 public records · 0 security-fix timeline events. 0 published in the last 7 days. 19 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 2
- High 7
- Medium 4
- Low 0
2026-08-0513 issues2026-11-02
Known exploited
View all known exploitedRecently published
Browse catalog- High7.1V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership HijackOpen the advisoryOct 12, 2026
- MediumV8 API Relationship Delete Bypasses Object-Level Authorization on the Related RecordOpen the advisoryOct 12, 2026
- High7.1Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)Open the advisoryOct 12, 2026
- High8.8Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)Open the advisoryOct 12, 2026
- MediumV8 OAuth2 Username EnumerationOpen the advisoryOct 12, 2026
- CriticalAdmin OS RCE via Dropdown Editor PHP InjectionOpen the advisoryOct 12, 2026
- Critical9.9LFI to RCE via AOW_WorkFlowOpen the advisoryAug 17, 2026
- High8.8Authenticated SQL Injection in AOR_Reports (value_type=Field) allows any low-privileged user to read the full databaseOpen the advisoryAug 17, 2026
- Medium6.5AOR Reports aor_fields.field SQL InjectionOpen the advisoryAug 5, 2026
- Medium6.5Authorization Bypass via Document Revision ID Confusion in download.phpOpen the advisoryAug 5, 2026