CVE-2026-108713

EUVD-2026-96987
SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point. Low-privileged users denied Campaigns access can post marketingId, campaignId, and templateId to reattach marketing messages or swap the template EmailMan sends in campaign emails.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 16.27%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
suitecrmsuitecrm
𝑥
≤ 7.15.2
CNA
suitecrmsuitecrm
8.0.0 ≤
𝑥
≤ 8.10.2
CNA
Common Weakness Enumeration
References
https://github.com/SuiteCRM/SuiteCRM
https://github.com/SuiteCRM/SuiteCRM-Core/blob/v8.10.2/public/legacy/modules/Campaigns/WizardCampaignSave.php#L88-L113
https://github.com/SuiteCRM/SuiteCRM/blob/v7.15.2/include/MVC/Controller/entry_point_registry.php#L93
https://github.com/SuiteCRM/SuiteCRM/blob/v7.15.2/modules/Campaigns/WizardCampaignSave.php#L88-L122
https://hackmd.io/@haind03/suitecrm-campaign-wizard-emailmarketing-missing-authorization
https://www.vulncheck.com/advisories/suitecrm-through-7.15.2-and-8.10.2-missing-authorization-via-setcampaignmarketingandtemplate