CVE-2025-64489

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account deactivation. An inactive user with an active session can continue to access the application and, critically, can self-reactivate their account. This undermines administrative controls and allows unauthorized persistence. This issue is fixed in versions 7.14.8 and 8.9.1.

• CWE-269

• https://github.com/SuiteCRM/SuiteCRM-Core/commit/30277cfe69755f7360a23d4805e06a5c38f14131Patch
• https://github.com/SuiteCRM/SuiteCRM/commit/40da2845a170832a4e9e9fa0ebe731f8c34de42dPatch
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-j6jg-9jj3-q2phVendor Advisory

Published

Nov 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64483Wazuh is a security detection, visibility, and compliance op…5.3
• CVE-2025-64484OAuth2-Proxy is an open-source tool that can act as either a…8.5
• CVE-2025-64485CVAT is an open source interactive video and image annotatio…5.3
• CVE-2025-64486calibre is an e-book manager. In versions 8.13.0 and prior, …9.3
• CVE-2025-64487Outline is a service that allows for collaborative documenta…7.6
• CVE-2025-64488SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2025-6449A vulnerability was found in code-projects Simple Online Hot…9.8
• CVE-2025-64490SuiteCRM is an open-source, enterprise-ready Customer Relati…8.3
• CVE-2025-64491SuiteCRM is an open-source, enterprise-ready Customer Relati…6.1
• CVE-2025-64492SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2025-64493SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5
• CVE-2025-64494Soft Serve is a self-hostable Git server for the command lin…4.6