Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

SuiteCRM bug bounty programs

suitecrm.com Updated

SuiteCRM runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
15
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program SuiteCRM runs.

  • SuiteCRM

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

15 targets. 6 excluded.

  • https://suitecrm.com

    Web

  • Authentication options in the tree, including LDAP and SAML, plus session handling and password reset

    Products and areas

  • File attachments and the upload directory, both the write path and the retrieval check

    Products and areas

  • Inbound and outbound email, including the inbound email monitor that parses messages from unauthenticated senders and the campaign and mass-mail surface

    Products and areas

  • Record import and export, which parses user-supplied files and writes records from them

    Products and areas

  • SecuritySuite security groups and roles, the record-level access control that decides who can see which customer

    Products and areas

  • Studio and the module builder, where an administrator defines new modules and fields and the product writes PHP to disk

    Products and areas

  • The customer-facing portal surface, where an external party signs in to see their own cases

    Products and areas

  • The installer, the repair and rebuild tools and the upgrade wizard, all of which run with high privilege

    Products and areas

  • The legacy core inherited from SugarCRM Community Edition: the bean layer, the module framework and the query construction underneath it

    Products and areas

  • The policy asks for private reports through the GitHub advisory tab under a published community security policy, and it draws no component boundary. The whole SuiteCRM application is in scope on both supported lines

    Products and areas

  • The reporting module and its filters, which build database queries from user-supplied criteria

    Products and areas

  • The REST APIs, both the legacy v4.1 service and the V8 API with its OAuth2 token model

    Products and areas

  • The SuiteCRM 8 front end and the API layer it talks to, which sits over that same legacy core

    Products and areas

  • Workflow and the scheduler, which execute stored configuration as privileged background jobs

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Hosting and server configuration, including a deployment that serves the upload directory as executable

  • Releases outside the lines the project currently supports

  • Security group or role configuration an administrator chose deliberately

  • SugarCRM's commercial products, which are a different vendor's code

  • Third-party SuiteCRM extensions and modules distributed outside the core repository

  • Upstream PHP library issues, unless SuiteCRM's own use of the library is what makes the defect reachable

Recent changes

Reward and scope changes across every SuiteCRM program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in SuiteCRM products, from the NVD.

Search NVD
  • CVE-2026-97377 High

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata a

  • CVE-2026-69142 High

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and cons

  • CVE-2026-69144 Medium

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved an

  • CVE-2026-69145 Medium

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL without strict field validation. An authenticated user able to configure reports can inject SQL through that stored field value and disclose database contents. Thi

  • CVE-2026-71548 High

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when value_type=Field without sufficient validation. An authenticated user who can save a report can use SQL injection to read the entire SuiteCRM database. Disclosed data can includ

  • CVE-2026-71550 Critical

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. The affected flow begins at modules/AOW_WorkFlow/controller.php and uses aow_action, and require_once() to carry attacker-controlled data

  • CVE-2026-69134 High

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST v4 JSON handler reads the pre-filter RAW_REQUEST value and relationship write helpers interpolate supplied field values into INSERT and UPDATE statements. The affected flow begins at $GLOBALS['RAW_REQUEST'] and uses set_relationship, SugarRelationship::addR

  • CVE-2026-69135 High

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. An authenticated attacker can alter query structure and disclose sensitive database information. This

About this page

This page gathers every public program listed under suitecrm.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.