CVE-2026-108713: SuiteCRM Authorization Bypass Vulnerability

CVE-2026-108713 Overview

CVE-2026-108713 is a missing authorization vulnerability [CWE-862] in SuiteCRM that affects versions through 7.15.2 and 8.x through 8.10.2. The flaw resides in the setCampaignMarketingAndTemplate entry point exposed by the Campaigns module. Authenticated users without Campaigns module access can create and modify EmailMarketing records by submitting marketingId, campaignId, and templateId parameters. Attackers can reattach marketing messages to campaigns or swap the template that EmailMan uses when sending campaign emails. The vulnerability affects the integrity of outbound marketing communications without requiring elevated privileges.

Critical Impact
Low-privileged authenticated users can modify campaign email templates and marketing records, enabling tampering of outbound customer communications sent through SuiteCRM campaigns.

Affected Products

SuiteCRM 7.x through 7.15.2
SuiteCRM 8.x through 8.10.2
SuiteCRM-Core deployments exposing the Campaigns/WizardCampaignSave.php entry point

Discovery Timeline

2026-10-11 - CVE-2026-108713 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108713

Vulnerability Analysis

The vulnerability exists in SuiteCRM's Campaign Wizard workflow, specifically the setCampaignMarketingAndTemplate entry point registered in include/MVC/Controller/entry_point_registry.php. This endpoint is reachable by any authenticated session, regardless of the user's role or module ACL grants. The handler in modules/Campaigns/WizardCampaignSave.php processes marketingId, campaignId, and templateId POST parameters and writes directly to the EmailMarketing bean. The code path omits the standard ACL check that gates the Campaigns module, breaking the authorization model enforced elsewhere in the application. See the HackMD Analysis of the Campaign Wizard flaw and the VulnCheck advisory for the full technical write-up.

Root Cause

The root cause is a missing authorization check [CWE-862] on an entry point that performs privileged operations. The handler trusts session authentication alone and does not verify that the caller holds Campaigns module access or ownership of the target EmailMarketing record. See the vulnerable code in WizardCampaignSave.php for 7.15.2 and the equivalent 8.10.2 handler.

Attack Vector

An authenticated user with any role, including roles explicitly denied Campaigns access, sends a POST request to the setCampaignMarketingAndTemplate entry point. The request body carries a target campaignId, a chosen marketingId, and a templateId pointing to an attacker-selected email template. The server persists the association, and EmailMan subsequently uses the swapped template when the campaign dispatches emails. This permits silent substitution of outbound marketing content, including links and body copy, without triggering role-based access denials.

No verified public exploit code is available. The vulnerability can be reproduced by issuing an authenticated HTTP POST to the vulnerable entry point with the three parameters described above.

Detection Methods for CVE-2026-108713

Indicators of Compromise

Unexpected HTTP POST requests to index.php?entryPoint=setCampaignMarketingAndTemplate from user sessions whose roles do not include Campaigns module access.
Unexplained changes to email_marketing database rows, particularly updates to template_id or campaign_id columns outside of normal administrator activity.
Campaign emails sent by EmailMan containing templates or links that differ from the administrator-approved content.

Detection Strategies

Correlate web server access logs with SuiteCRM audit logs to identify calls to setCampaignMarketingAndTemplate originating from non-marketing users.
Enable database-level auditing on the email_marketing and campaigns tables and alert on UPDATE or INSERT operations outside expected maintenance windows.
Review user session telemetry for low-privileged accounts issuing requests to Campaigns module entry points.

Monitoring Recommendations

Forward SuiteCRM application and web server logs to a centralized logging platform and build a rule that flags requests to the vulnerable entry point.
Baseline normal Campaigns module usage per role and alert on deviations, particularly template or marketing message reassignments.
Monitor outbound SMTP traffic generated by EmailMan for sudden changes in email body content, embedded URLs, or sender metadata.

How to Mitigate CVE-2026-108713

Immediate Actions Required

Upgrade SuiteCRM to a release that patches CVE-2026-108713 once published by the vendor; monitor the SuiteCRM GitHub repository for the fixed version.
Audit email_marketing records for unauthorized changes to template_id and campaign_id fields and revert tampered entries.
Restrict access to the SuiteCRM instance to trusted networks and enforce multi-factor authentication to reduce the pool of accounts that can reach the vulnerable entry point.

Patch Information

At the time of publication, no fixed version is identified in the NVD record. Operators of SuiteCRM 7.x through 7.15.2 and 8.x through 8.10.2 should track the SuiteCRM GitHub repository and the VulnCheck advisory for release notes referencing CVE-2026-108713.

Workarounds

Block external access to the setCampaignMarketingAndTemplate entry point at a reverse proxy or web application firewall until an official patch is applied.
Apply a local patch that adds an ACL check for the Campaigns module at the top of modules/Campaigns/WizardCampaignSave.php and rejects requests from users without the required role.
Revoke write access to the email_marketing table from the SuiteCRM database user where business processes allow, limiting the blast radius of unauthorized writes.

bash

# Example reverse proxy rule (nginx) to block the vulnerable entry point
location /index.php {
    if ($arg_entryPoint = "setCampaignMarketingAndTemplate") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php-upstream;
}