Vulnerability · Published Nov 8, 2025 · Assigned by GitHub_M

CVE-2025-64490SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass

High 8.3

In plain English

A high-severity incorrect authorization in SuiteCRM from SuiteCRM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.3%top 79.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 allow a low-privileged user with a restrictive role to view and create work items through the Resource Calendar and project screens, even when the related modules (Projects, Project Tasks, Tasks, Leads, Accounts, Meetings, Calls) are explicitly set to Disabled/None in Role Management. This indicates inconsistent ACL/RBAC enforcement across modules and views, resulting in unauthorized data exposure and modification. This issue is fixed in versions 7.14.8 and 8.9.1.

Affected products (as reported)

Vendor	Product	Versions
SuiteCRM	SuiteCRM	< 7.14.8>= 8.0.0-beta.1, < 8.9.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-jh8v-wqgj-hhc2 x_refsource_CONFIRM