CVE-2021-25961

SuiteCRM - Account Takeover in Password Reset Functionality

8.0 HighFix available

In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.96%Up 0.1 points since Sep 30, 2021

What each source reports

CVE List Score used8.0

SuiteCRM - Account Takeover in Password Reset Functionality

Record: CVE-2021-25961
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-640
Updated: 2026-11-02

EUVDEUVD-2021-128028.0

Record: EUVD-2021-12802
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qgww-6vq6-rm44No score

In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to...

Record: GHSA-qgww-6vq6-rm44
Weakness: CWE-640
Updated: 2026-11-02

NVD8.0

Record: CVE-2021-25961
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness: CWE-640
Updated: 2026-11-02

OSV8.0

Record: CVE-2021-25961
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBIT-suitecrm-2021-25961No score

SuiteCRM - Account Takeover in Password Reset Functionality

Record: BIT-suitecrm-2021-25961
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`suitecrm` Bitnami	7.1.7 up to 7.10.32, 7.11.0 up to 7.11.21	7.10.327.11.21

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-25961 is a high vulnerability (CVSS 8.0) in Salesagility Suitecrm, published September 29, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in suitecrm 7.10.32.