CVE-2026-108712: SuiteCRM Information Disclosure Flaw

CVE-2026-108712 Overview

CVE-2026-108712 is a missing authorization vulnerability [CWE-862] in SuiteCRM through versions 7.15.2 and 8.10.2. The flaw resides in the DetailUserRole entry point within the ACLRoles module. Authenticated non-admin users can supply another non-admin user's identifier in the record parameter to retrieve that user's assigned roles and per-module Access Control List (ACL) action matrix. The issue stems from the entry point exposing role detail data without verifying that the requesting user has administrative privileges or ownership of the target record.

Critical Impact
Any authenticated SuiteCRM user can enumerate other non-admin users' role assignments and ACL permission matrices, exposing authorization structure that supports further targeted attacks.

Affected Products

SuiteCRM 7.x through 7.15.2
SuiteCRM 8.x through 8.10.2
SuiteCRM-Core deployments exposing the legacy ACLRoles/DetailUserRole.php entry point

Discovery Timeline

2026-10-11 - CVE-2026-108712 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108712

Vulnerability Analysis

The vulnerability exists in modules/ACLRoles/DetailUserRole.php, which is registered as a public entry point in include/MVC/Controller/entry_point_registry.php. The handler reads the record parameter from the HTTP request and renders the ACL role matrix for the user identified by that value. It performs authentication checks but omits authorization checks that would restrict access to administrators or to the record owner. As a result, a low-privileged authenticated user can issue a request specifying an arbitrary non-admin user id and receive that user's assigned roles together with the module-level permission grid (view, list, edit, delete, import, export, mass update, access).

Root Cause

The root cause is the absence of a role or ownership check in the DetailUserRole entry point before returning ACL data. SuiteCRM treats the entry point as reachable by any authenticated session, but the ACL matrix it exposes is administrative data that should be gated by the is_admin property or an equivalent authorization predicate. This matches the pattern described by CWE-862: Missing Authorization.

Attack Vector

Exploitation requires only a valid non-admin session on the target SuiteCRM instance. The attacker issues an HTTP GET to the DetailUserRole entry point and sets record to the id of another non-admin user. The server returns the target user's role assignments and the full per-module ACL action matrix. No elevated privileges, user interaction, or additional conditions are required. Technical write-ups are available in the VulnCheck Advisory on SuiteCRM and the HackMD CVE-2026-108712 Analysis.

No verified proof-of-concept code is published. Refer to the SuiteCRM ACLRoles Detail Code for the vulnerable handler implementation.

Detection Methods for CVE-2026-108712

Indicators of Compromise

HTTP requests to index.php?entryPoint=DetailUserRole or /legacy/index.php?entryPoint=DetailUserRole originating from non-admin sessions.
Requests to DetailUserRole where the record parameter contains a user id that does not match the authenticated session's user id.
Repeated DetailUserRole requests enumerating multiple distinct record values within a short interval, indicating ACL harvesting.

Detection Strategies

Correlate web server access logs with SuiteCRM session data to flag DetailUserRole requests issued by sessions lacking the is_admin flag.
Baseline normal administrative access to ACLRoles endpoints and alert on access from accounts outside the administrator group.
Deploy a Web Application Firewall (WAF) rule that denies requests to the DetailUserRole entry point when the session role is not administrator.

Monitoring Recommendations

Forward SuiteCRM application and web server logs to a centralized Security Information and Event Management (SIEM) platform for correlation with identity context.
Monitor for sequential record parameter changes against ACL-related entry points, which indicate scripted enumeration.
Review audit trails for non-admin accounts accessing user administration or role modules outside documented change windows.

How to Mitigate CVE-2026-108712

Immediate Actions Required

Restrict HTTP access to the DetailUserRole entry point to administrator sessions via reverse proxy or WAF rules until a patched release is deployed.
Audit SuiteCRM user accounts and disable or rotate credentials for accounts that no longer require access.
Review web server logs for prior access to DetailUserRole from non-admin sessions to assess data exposure.

Patch Information

At the time of publication, no fixed version is identified in the NVD record beyond the affected ranges (SuiteCRM through 7.15.2 and 8.10.2). Monitor the SuiteCRM GitHub Repository and the VulnCheck Advisory on SuiteCRM for an upstream fix that adds an administrator check to the DetailUserRole handler.

Workarounds

Block the DetailUserRole entry point at the web server layer for all non-admin source identities.
Apply a local patch to modules/ACLRoles/DetailUserRole.php that verifies $current_user->is_admin before rendering the ACL matrix and returns HTTP 403 otherwise.
Enforce principle of least privilege on SuiteCRM accounts and limit module access using the native ACL system to reduce the value of exposed role data.

bash

# Example Apache rule restricting DetailUserRole to internal admin network
<Location "/index.php">
    SetEnvIfNoCase Request_URI "entryPoint=DetailUserRole" RESTRICT_ACL
    Require all granted
    <RequireAll>
        Require env RESTRICT_ACL
        Require ip 10.0.0.0/24
    </RequireAll>
</Location>