CVE-2026-29189 identifies a critical access control vulnerability within the SuiteCRM REST API V8, affecting versions prior to 7.15.1 and 8.9.3. This flaw allows authenticated users to bypass Access Control List (ACL) checks on several endpoints, leading to unauthorized access and manipulation of data they should not have permission to interact with. With a CVSS score of 8.1 (High), the vulnerability has a network attack vector, low attack complexity, and requires low privileges to achieve high confidentiality and integrity impacts. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed on CISA's Known Exploited Vulnerabilities catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 7.15.1CPE matchmatch criteria | cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:* | ||
>= 8.0.0, < 8.9.3CPE matchmatch criteria | cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.