CVE-2025-64490 - CVE House
Back to Database
Status published High CVE-2025-64490

SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass

Vulnerability Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 allow a low-privileged user with a restrictive role to view and create work items through the Resource Calendar and project screens, even when the related modules (Projects, Project Tasks, Tasks, Leads, Accounts, Meetings, Calls) are explicitly set to Disabled/None in Role Management. This indicates inconsistent ACL/RBAC enforcement across modules and views, resulting in unauthorized data exposure and modification. This issue is fixed in versions 7.14.8 and 8.9.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64490

Credits & Attribution

No credits recorded in the NVD database.

References

More from SuiteCRM

View All →
CVE-2025-64493
SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL
Medium 6.5
CVE-2025-64492
SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection
High 8.8
CVE-2025-64491
SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page
Medium 6.1
CVE-2025-64489
SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass
High 8.3
CVE-2025-64488
SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module
High 8.6

Affected Vendor

Affected Software

SuiteCRM
Vulnerable Versions:
< 7.14.8, >= 8.0.0-beta.1, < 8.9.1

Timeline

Official Publish: November 8th, 2025
Last Modified: November 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-863

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion