7 matches found
SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF
SuiteCRM CalendarAccount testConnection accepts an attacker-controlled serverurl and passes it to cURL without destination validation. An authenticated user can cause a server-side request to loopback or internal network services. id: CVE-2026-69137 info: name: SuiteCRM = 7.15.1, = 8.10.1 -...
CVE-2026-69137
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's serverurl directly to curl without host, address, or scheme validation. The affected flow...
CVE-2026-69137
SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to an authenticated Server-Side Request Forgery (SSRF) in the CalendarAccount::action_testConnection action. The flaw exists because the application passes the server_url parameter directly to cURL without validating the host, address, o...
CVE-2026-69137 SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's serverurl directly to curl without host, address, or scheme validation. The affected flow...
CVE-2026-69137 SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's serverurl directly to curl without host, address, or scheme validation. The affected flow...
SuiteCRM 8.10.1 Authenticated Server-Side Request Forgery
SuiteCRM versions through 7.15.1 and 8.10.1 contain an authenticated server-side request forgery vulnerability in CalendarAccount testConnection. The proof of concept submits a supplied CalDAV server URL to demonstrate server-side request handling...
