The vulnerability arises because the RecordHandler::getRecord() method in SuiteCRM bypasses the ACLAccess('view') check that would normally restrict which records an authenticated user can view. An attacker who is logged in can request any record by module and ID, effectively bypassing all access control for read operations. This permits the disclosure of confidential customer or business data, compromising the confidentiality of the organization’s information resources.

Vulnerable instances are all SuiteCRM Core versions released before 8.9.3, regardless of the module or record type. The issue is specific to the SuiteCRM core component and affects all authenticated users who have login access to the application. Version 8.9.3 and later include a patch that restores the correct ACL check.

The CVSS base score of 6.5 indicates a moderate severity, while the EPSS of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, which further indicates that no publicly known exploits exist. The attack vector is inferred to be authenticated, as the exploit requires the user to be logged in. Once authenticated, an attacker can read any record, leading to potential data leakage across the organization.