CVE-2026-61649

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description An authenticated attacker can bypass IP validation by placing the server hostname in a URL path, allowing server-side requests to be directed to internal services. This occurs because the Server-Side Request Forgery (SSRF) protection—a vulnerability where a server is tricked into making requests to an unintended location—uses a substring comparison in the isSelfRequest() function instead of hostname equality. The affected flow starts at validate external host() and utilizes isSelfRequest() and stripos() to process attacker-controlled data.

Recommendations Update SuiteCRM to version 7.15.2 or later. Update SuiteCRM to version 8.10.2 or later.