CVE-2023-47643

SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash. This issue is patched in version 8.4.2. There are no known workarounds.

• CWE-200

• https://github.com/salesagility/SuiteCRM-Core/commit/117dd8172793a239f71c91222606bf00677eeb33Patch
• https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-fxww-jqfv-9rrrExploit, Vendor Advisory
• https://www.apollographql.com/blog/graphql/security/why-you-should-disable-graphql-introspection-in-production/Technical Description
• https://github.com/salesagility/SuiteCRM-Core/commit/117dd8172793a239f71c91222606bf00677eeb33Patch
• https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-fxww-jqfv-9rrrExploit, Vendor Advisory
• https://www.apollographql.com/blog/graphql/security/why-you-should-disable-graphql-introspection-in-production/Technical Description

Published

Nov 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47638Rejected reason: Confirm reference is not public.
• CVE-2023-47639API Platform Core is a system to create hypermedia-driven RE…5.3
• CVE-2023-4764Incorrect security UI in BFCache in Google Chrome prior to 1…6.5
• CVE-2023-47640DataHub is an open-source metadata platform. The HMAC signat…8.8
• CVE-2023-47641aiohttp is an asynchronous HTTP client/server framework for …6.5
• CVE-2023-47642Zulip is an open-source team collaboration tool. It was disc…4.3
• CVE-2023-47644Cross-Site Request Forgery (CSRF) vulnerability in profilegr…8.8
• CVE-2023-47645Cross-Site Request Forgery (CSRF) vulnerability in Registrat…8.8
• CVE-2023-47646Auth. (Shop Manager+) Stored Cross-Site Scripting (XSS) vuln…4.8
• CVE-2023-47647Missing Authorization vulnerability in LearningTimes BadgeOS…4.3
• CVE-2023-47648Missing Authorization vulnerability in Spider Themes EazyDoc…7.5
• CVE-2023-47649Cross-Site Request Forgery (CSRF) vulnerability in PriceList…8.8