SuiteCRM Record Handler ACL Bypass Vulnerability Allowing Unauthorized Record Access

A vulnerability exists in SuiteCRM versions through 8.9.2 in the `RecordHandler::getRecord()` method, which retrieves records by module and ID without verifying the user's ACL view permission. This oversight allows any authenticated user to access records across all modules, bypassing SuiteCRM's ACL system for read operations. The `saveRecord()` method, in contrast, properly checks save permissions. The vulnerability can be exploited via the REST API or GraphQL queries.

Impact

Exploitation of this vulnerability allows any authenticated user to read any record from any module, bypassing the application's access control mechanisms for read operations.

Remediation

Users can upgrade to SuiteCRM version 8.9.3 or later to address this vulnerability.