SuiteCRM Password Hash Exposure Vulnerability in User API Endpoint

A vulnerability in SuiteCRM's API user endpoint prior to version 8.9.3 allows authenticated users to access sensitive information about other users, including password hashes, usernames, and multi-factor authentication configurations. This issue could be exploited to retrieve and potentially crack the passwords of administrative users.

Impact

Exploitation of this vulnerability allows authenticated users to access the password hashes of other users, including administrators, which could lead to unauthorized access by cracking these hashes.

Remediation

Users can upgrade to SuiteCRM version 8.9.3 or later to address this vulnerability.