← Vulnerability feed

Vulnerability record · CVE-2025-64489 · published 8 November 2025

CVE-2025-64489: Salesagility suitecrm improper privilege management vulnerability

SSalesagility · Suitecrm

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account deactivation. An inactive user with an active session can continue to access the application and, critically, can self-reactivate their account. This undermines administrative controls and allows unauthorized persistence. This issue is fixed in versions 7.14.8 and 8.9.1.

8.8 CVSS 3.1 High EPSS 0.34% · top 75.4% CWE-269 · Improper privilege management
8.8CVSS 3.1 base score
0.34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account deactivation. An inactive user with an active session can continue to access the application and, critically, can self-reactivate their account. This undermines administrative controls and allows unauthorized persistence. This issue is fixed in versions 7.14.8 and 8.9.1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/SuiteCRM/SuiteCRM-Core/commit/30277cfe69755f7360a23d4805e06a5c38f14131 Patch
https://github.com/SuiteCRM/SuiteCRM/commit/40da2845a170832a4e9e9fa0ebe731f8c34de42d Patch
https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-j6jg-9jj3-q2ph Vendor Advisory

Track CVE-2025-64489 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-36412Salesagility suitecrm sql injection vulnerabilitySuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events…EPSS 5.7%9.8CVE-2023-6126Salesagility suitecrm code injection vulnerabilityCode Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.EPSS 0.69%9.8CVE-2021-45898Salesagility suitecrm vulnerabilitySuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion.EPSS 1.1%9.8CVE-2021-45899Salesagility suitecrm deserialization of untrusted data vulnerabilitySuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution.EPSS 2.2%9.8CVE-2020-8783Salesagility suitecrm sql injection vulnerabilitySuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4).EPSS 1.1%9.8CVE-2020-8784Salesagility suitecrm sql injection vulnerabilitySuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4).EPSS 1.1%9.8CVE-2020-8785Salesagility suitecrm sql injection vulnerabilitySuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4).EPSS 1.1%9.8CVE-2020-8786Salesagility suitecrm sql injection vulnerabilitySuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4).EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2025-64489), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.