CVE-2026-32697

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the `RecordHandler::getRecord()` method retrieves any record by module and ID without checking the current user's ACL view permission. The companion `saveRecord()` method correctly checks `$bean->ACLAccess('save')`, but `getRecord()` skips the equivalent `ACLAccess('view')` check. Version 8.9.3 patches the issue.

• CWE-639

• https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-9p9g-224x-6rmmVendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32691A race condition in the secrets management subsystem of Juju…5.3
• CVE-2026-32692An authorization bypass vulnerability in the Vault secrets b…6.5
• CVE-2026-32693In Juju from version 3.0.0 through 3.6.18, the authorization…8.8
• CVE-2026-32694In Juju from version 3.0.0 through 3.6.18, when a secret own…6.6
• CVE-2026-32695Traefik is an HTTP reverse proxy and load balancer. Prior to…7.7
• CVE-2026-32696NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …7.5
• CVE-2026-32698OpenProject is an open-source, web-based project management …7.2
• CVE-2026-32699FacturaScripts is an open source accounting and invoicing so…5.3
• CVE-2026-3270A vulnerability has been found in psi-probe PSI Probe up to …8.8
• CVE-2026-32700Devise is an authentication solution for Rails based on Ward…5.3
• CVE-2026-32701Qwik is a performance-focused JavaScript framework. Versions…7.5
• CVE-2026-32702Cleanuparr is a tool for automating the cleanup of unwanted …5.3