A suiteCRM API endpoint that accepts authenticated requests mistakenly returns comprehensive user data, including password hashes, usernames, and MFA settings. This flaw constitutes an information disclosure weakness (CWE‑200) and permits an attacker who has valid login credentials to harvest password hashes for any user, including administrative accounts. If an attacker replays a hashed value or conducts offline cracking, they can potentially obtain plaintext passwords and elevate privileges within the system.

All instances of suiteCRM Core running versions earlier than 8.9.3 are affected. The vulnerability originates from the default API response configuration and does not require any additional configuration changes. Updating to 8.9.3 or later eliminates the exposed endpoint and restores proper access controls.

The CVSS base score of 6.5 reflects a medium severity vulnerability, and the EPSS probability of exploitation is under 1 %, indicating that attacks are currently uncommon. Because the flaw relies on an authenticated session, an adversary needs only valid user credentials or social‑engineering access to the application. Once authenticated, the attacker can query the vulnerable endpoint over any network channel that permits API traffic. The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation to date.