CVE-2025-54786: medium-severity vulnerability in SuiteCRM-Core
SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
SuiteCRM · SuiteCRM-CoreRelated CVEs — SuiteCRM-Core
In the same product, most dangerous first.
CVE-2026-29109HIGHSuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter ProcessingEPSS 0.5%CVE-2025-64492HIGHSuiteCRM is Vulnerable to Authenticated Time Based Blind SQL InjectionEPSS 0.4%CVE-2025-64493MEDIUMSuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQLEPSS 0.4%CVE-2026-29108MEDIUMAuthenticated SuiteCRM Users Can Retrieve The Password Hash of Any UserEPSS 0.3%CVE-2026-32697MEDIUMSuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)EPSS 0.3%