SuiteCRM’s REST API V8 suffers from missing ACL checks on several endpoints, which enables authenticated users to read or modify data that should be restricted to other users. This flaw fulfills the criterion of a typical IDOR vulnerability and is mapped to CWE‑639, signifying a privilege escalation risk. The consequence is that an attacker can expose confidential information or alter records, potentially compromising customer data and undermining business integrity.

All SuiteCRM installations running versions earlier than 7.15.1 or 8.9.3 are affected. The vulnerability has been confirmed on the SuiteCRM product across all supported database backends and does not rely on a specific module, meaning any deployment that relies on the V8 REST API is at risk until it is upgraded.

The CVSS base score is 8.1, indicating a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation is not widespread at this time, and the vulnerability is not listed in the CISA KEV catalog. However, exploitation is straightforward for legitimate users who have legitimate login credentials; the attacker simply issues REST requests to the vulnerable endpoints. The lack of server‑side authorization checks makes the attack reliable in the presence of valid authentication credentials.