| Package | Affected versions | Patched versions |
|---|---|---|
| suitecrm | ≥ 8.0.0, < 8.9.1< 7.14.8 | 8.9.17.14.8 |
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account deactivation. An inactive user with an active session can continue to access the application and, critically, can self-reactivate their account. This undermines administrative controls and allows unauthorized persistence. This issue is fixed in versions 7.14.8 and 8.9.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free