CVEvulnerability

CVE-2025-54786

5.3 MEDIUM Published 2025-08-07 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-08-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-284, CWE-287

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1.

Affected configurations

• salesagility suitecrm 7.14.6 • salesagility suitecrm 8.8.0

Related

Weakness · CWE (3)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-284 Improper Access Control weakness
  • CWE-287 Improper Authentication weakness

References