CVE-2026-69144

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description An identifier confusion issue exists in the 'download.php' endpoint. The application performs authorization checks against a Documents bean before determining if the provided identifier is a document revisions.id. If a revision UUID is submitted using the type parameter set to 'Documents', the system checks an empty Documents bean and serves the revision without verifying the parent document. This allows a low-privileged authenticated user to download protected or administrator-owned documents.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.