CVE-2026-63218

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The changeReportPage controller action renders protected reports without repeating the record-level access check enforced by DetailView. The affected flow starts at AOR Reports and utilizes changeReportPage and DetailView to pass attacker-controlled data or authorization states into a security-sensitive operation. This allows an authenticated user to directly invoke the action to read report rows and restricted-module data, bypassing owner-only or role-based report visibility.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.