CVE-2026-69144 SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a documentrevisions.id. When a revision UUID is...

CVE-2026-69144 SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a documentrevisions.id. When a revision UUID is...

CVE-2026-69144

In SuiteCRM versions prior to 7.15.2 and 8.10.2 , an authorization bypass exists in download.php due to Document Revision ID confusion . The application checks authorization against a Documents bean before determining if the provided identifier is a document_revisions.id. By submitting a revision...