VULNERABILITY INTELLIGENCE

CVE-2025-54786

CVSS score5.3 MEDIUM
EPSS probability0.30%
CISA KEVNot currently listed
Published2025-08-07
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1.

Weakness classification

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-284: Improper Access Control
  • CWE-287: Improper Authentication

Primary references