{"affected":[{"product":"SuiteCRM","source":"CNA: GitHub_M","vendor":"SuiteCRM","versions":[{"status":"affected","version":"< 7.15.2"},{"status":"affected","version":">= 8.0.0, < 8.10.2"}]},{"ecosystem":"","packageName":"SuiteCRM","product":"SuiteCRM","source":"GitHub GHSA-72r3-24x4-j46c","vendor":"","versions":[{"status":"affected","version":"<= 7.15.1","versionType":"GitHub advisory range"}]},{"ecosystem":"","packageName":"SuiteCRM","product":"SuiteCRM","source":"GitHub GHSA-72r3-24x4-j46c","vendor":"","versions":[{"status":"affected","version":"<= 8.10.1","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-69137","cwes":["CWE-918"],"description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly to curl without host, address, or scheme validation. The affected flow begins at CalendarAccount::action_testConnection and uses server_url, CalDAVProvider::makeCalDAVRequest(), and PROPFIND to carry attacker-controlled data or authorization state into the security-sensitive operation. The server sends a PROPFIND request from its network context and returns non-success response bodies, enabling internal-service access, partial response disclosure, service enumeration, and possible cloud metadata access. This issue is fixed in versions 7.15.2 and 8.10.2.","epss":{"date":"2026-11-09","percentile":0.89976,"score":0.03759},"exploits":[],"kev":null,"metrics":[{"score":7.7,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},{"score":7.7,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794246284546,"publishedAt":1793902877980,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-72r3-24x4-j46c"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-72r3-24x4-j46c"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-72r3-24x4-j46c"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-72r3-24x4-j46c","text":"SuiteCRM: GitHub reports patched versions 7.15.2. Check the advisory for the affected release branch.","url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-72r3-24x4-j46c"},{"kind":"fix","source":"GitHub GHSA-72r3-24x4-j46c","text":"SuiteCRM: GitHub reports patched versions 8.10.2. Check the advisory for the affected release branch.","url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-72r3-24x4-j46c"}],"revision":"f6e63291940f5efd000cecc2db3731e9b64789fa4aa0609b161a1ecd3e3867f5","sources":[{"modifiedAt":1794246284546,"name":"CNA: GitHub_M","retrievedAt":1794247888024,"url":"https://www.cve.org/CVERecord?id=CVE-2026-69137"},{"modifiedAt":1793906245280,"name":"NVD","retrievedAt":1793946370053,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69137"},{"modifiedAt":1785929717000,"name":"GitHub Security Advisories","retrievedAt":1794072309526,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-72r3-24x4-j46c"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794247910489,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69137"}],"ssvc":{"assessedAt":1794245742555,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure","updatedAt":1794247910489}