CVE-2026-63217

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The generatePdf entry point in the modules/AOS PDF Templates/generatePdf.php file loads arbitrary records using the BeanFactory::getBean() function without verifying the requesting user's access permissions. This allows any authenticated user to bypass Access Control List (ACL) roles and read sensitive information from records they are not authorized to access, including financial, contact, deal, and custom-field data.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.