SuiteCRM’s WebToLead capture feature accepts a user‑supplied POST parameter and redirects the user without validating the target URL. This allows an attacker to send victims to arbitrary external sites, potentially facilitating phishing or other social‑engineering attacks. The vulnerability does not directly compromise data or execute code, but it enables the trusted domain to be abused as a launchpad for malicious traffic.

The issue affects SuiteCRM installations running any version prior to 7.15.1 and 8.9.3. Administrators should verify the current release and apply the patch for the specific version in use.

The CVSS score of 5.4 places the vulnerability in the medium severity range. The EPSS score is below 1%, indicating a low likelihood of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is unauthenticated HTTP POST requests to the WebToLead endpoint, requiring no special privileges or credentials. When an attacker supplies a crafted URL, the system will redirect the victim automatically, enabling a phishing chain.