CVE-2026-29108: fallo de gravedad media en SuiteCRM-Core
Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.3%
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, an authenticated API endpoint allows any user to retrieve detailed information about any other user, including their password hash, username, and MFA configuration. As any authenticated user can query this endpoint, it's possible to retrieve and potentially crack the passwords of administrative users. Version 8.9.3 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Productos afectados
SuiteCRM · SuiteCRM-CoreCVEs relacionadas — SuiteCRM-Core
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-29109HIGHSuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter ProcessingEPSS 0.5%CVE-2025-64492HIGHSuiteCRM is Vulnerable to Authenticated Time Based Blind SQL InjectionEPSS 0.4%CVE-2025-64493MEDIUMSuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQLEPSS 0.4%CVE-2025-54786MEDIUMSuiteCRM: Legacy iCal service allows unauthenticated access to meeting dataEPSS 0.3%CVE-2026-32697MEDIUMSuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)EPSS 0.3%