Vulnerability · Published Nov 6, 2025 · Assigned by VulnCheck

CVE-2022-50590SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality

High 8.8

In plain English

A high-severity type confusion in SuiteCRM from SuiteCRM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.4%top 66.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including changing the email address of the administrator.

Affected products (as reported)

Vendor	Product	Versions
SuiteCRM	SuiteCRM	0 – before 7.12.6

Weakness: CWE-843 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6 vendor-advisory, patch
https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-deleteattachment-type-confusion-vulnerability/ technical-description
https://www.vulncheck.com/advisories/suitecrm-type-confusion-via-deleteattachment-functionality third-party-advisory