SuiteCRM REST API V8 Missing ACL Checks Allowing Unauthorized Data Access and Manipulation

A vulnerability exists in the SuiteCRM REST API V8, prior to versions 7.15.1 and 8.9.3, due to missing Access Control List (ACL) checks on several endpoints. This flaw enables authenticated users to access and modify data without proper authorization. Specifically, users can read other users' preferences and settings, and manipulate relationships between records, bypassing established data isolation measures.

Impact

Exploitation of this vulnerability allows authenticated users to access and modify data they should not have permission to, including reading other users' preferences and manipulating relationships between records, potentially leading to unauthorized data exposure and modification.

Remediation

Users can upgrade to SuiteCRM versions 7.15.1 or 8.9.3 to address this vulnerability.