CVE-2026-69144

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved and served without checking its parent document. A low-privileged authenticated user can use this identifier confusion to download administrator-owned or otherwise protected documents. This issue is fixed in versions 7.15.2 and 8.10.2.

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved and served without checking its parent document. A low-privileged authenticated user can use this identifier confusion to download administrator-owned or otherwise protected documents. This issue is fixed in versions 7.15.2 and 8.10.2.

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved and served without checking its parent document. A low-privileged authenticated user can use this identifier confusion to download administrator-owned or otherwise protected documents. This issue is fixed in versions 7.15.2 and 8.10.2.

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved and served without checking its parent document. A low-privileged authenticated user can use this identifier confusion to download administrator-owned or otherwise protected documents. This issue is fixed in versions 7.15.2 and 8.10.2.