SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)
Summary
SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)
Original description
The description as published by the source.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the RecordHandler::getRecord() method retrieves any record by module and ID without checking the current user's ACL view permission. The companion saveRecord() method correctly checks $bean->ACLAccess('save'), but getRecord() skips the equivalent ACLAccess('view') check. Version 8.9.3 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov