SuiteCRM’s SSRF protection in versions prior to 7.15.2 and 8.10.2 relies on a substring comparison inside the isSelfRequest() function instead of strict hostname equality. This flaw allows an authenticated attacker to embed the server’s own hostname into a crafted URL path, bypassing the IP validation that was intended to block internal requests. The application then performs a server‑side request to the specified internal service, effectively exposing internal resources through the web interface.

All SuiteCRM installations running a version earlier than 7.15.2 or 8.10.2 are susceptible. The affected product is SuiteCRM SuiteCRM; any instance with the vulnerable SSRF protection enabled is at risk.

The CVSS score of 7.7 indicates a high severity vulnerability. The EPSS score is not available, so a precise exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated attacker submitting a crafted URL that contains the internal hostname via an input field that triggers the SSRF flow. The impact is that the application can initiate requests to internal services that should otherwise be unreachable through the public interface.