- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 15
- Public CVEs
- 50
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
15 assets you may test, 6 excluded.
Web 1
- https://suitecrm.com
Products and areas 14
- Authentication options in the tree, including LDAP and SAML, plus session handling and password reset
- File attachments and the upload directory, both the write path and the retrieval check
- Inbound and outbound email, including the inbound email monitor that parses messages from unauthenticated senders and the campaign and mass-mail surface
- Record import and export, which parses user-supplied files and writes records from them
- SecuritySuite security groups and roles, the record-level access control that decides who can see which customer
- Studio and the module builder, where an administrator defines new modules and fields and the product writes PHP to disk
- The customer-facing portal surface, where an external party signs in to see their own cases
- The installer, the repair and rebuild tools and the upgrade wizard, all of which run with high privilege
- The legacy core inherited from SugarCRM Community Edition: the bean layer, the module framework and the query construction underneath it
- The policy asks for private reports through the GitHub advisory tab under a published community security policy, and it draws no component boundary. The whole SuiteCRM application is in scope on both supported lines
- The reporting module and its filters, which build database queries from user-supplied criteria
- The REST APIs, both the legacy v4.1 service and the V8 API with its OAuth2 token model
- The SuiteCRM 8 front end and the API layer it talks to, which sits over that same legacy core
- Workflow and the scheduler, which execute stored configuration as privileged background jobs
Out of scope (6)
- Hosting and server configuration, including a deployment that serves the upload directory as executable
- Releases outside the lines the project currently supports
- Security group or role configuration an administrator chose deliberately
- SugarCRM's commercial products, which are a different vendor's code
- Third-party SuiteCRM extensions and modules distributed outside the core repository
- Upstream PHP library issues, unless SuiteCRM's own use of the library is what makes the defect reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Use the "Report a Vulnerability" tab on salesagility/SuiteCRM, the channel the SECURITY.md names
-
Read the fuller community security policy at docs.suitecrm.com before filing; it is the more detailed document and sets the expectations triage works to
-
Say which line you tested. SuiteCRM 7 and SuiteCRM 8 are different enough that a finding in one may not exist in the other, and 8 still carries the legacy core underneath
-
A defect inherited from SugarCRM Community Edition code still gets reported here. SugarCRM is a separate commercial vendor and is not the maintainer of this fork
-
Give the security group configuration your reproduction assumed. SecuritySuite record access is the product's main authorisation mechanism and a report without it cannot be reproduced
-
There is no reward tier and no payment to negotiate
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-97377 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata a | High 8.8 | 5 Nov 2026 |
| CVE-2026-69142 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and cons | High 8.8 | 5 Nov 2026 |
| CVE-2026-69144 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved an | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-69145 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL without strict field validation. An authenticated user able to configure reports can inject SQL through that stored field value and disclose database contents. Thi | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-71548 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when value_type=Field without sufficient validation. An authenticated user who can save a report can use SQL injection to read the entire SuiteCRM database. Disclosed data can includ | High 8.8 | 5 Nov 2026 |
| CVE-2026-71550 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. The affected flow begins at modules/AOW_WorkFlow/controller.php and uses aow_action, and require_once() to carry attacker-controlled data | Critical 9.9 | 5 Nov 2026 |
| CVE-2026-69134 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST v4 JSON handler reads the pre-filter RAW_REQUEST value and relationship write helpers interpolate supplied field values into INSERT and UPDATE statements. The affected flow begins at $GLOBALS['RAW_REQUEST'] and uses set_relationship, SugarRelationship::addR | High 8.8 | 5 Nov 2026 |
| CVE-2026-69135 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. An authenticated attacker can alter query structure and disclose sensitive database information. This | High 7.1 | 5 Nov 2026 |
| CVE-2026-69136 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the remove_attachment POST parameter array through HTML-oriented securexss() processing and directly interpolates its elements into an SQL UPDATE statement. An authenticated attacker can inject SQL to disclose database infor | High 7.1 | 5 Nov 2026 |
| CVE-2026-69137 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly to curl without host, address, or scheme validation. The affected flow begins at CalendarAccount::action_testConnection and uses server_url, CalDAVProvider::makeCalDAVRequ | High 7.7 | 5 Nov 2026 |
| CVE-2026-69140 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates get_latest_for_id directly into an SQL UPDATE statement. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a l | High 8.3 | 5 Nov 2026 |
| CVE-2026-69141 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CasesController action_get_kb_articles action interpolates $_POST['search'] into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed | High 8.3 | 5 Nov 2026 |
| CVE-2026-63214 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause after insufficient structural validation. The affected flow begins at /service/v4_1/rest.php and uses get_entry_list, get_entries_count, and query to carry attacker-controlled | High 8.8 | 5 Nov 2026 |
| CVE-2026-63215 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 get_entry_list method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security mechanisms. The advisory does not identify those controls more precisely, so their identities remain | High 8.3 | 5 Nov 2026 |
| CVE-2026-63217 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the generatePdf entry point loads an arbitrary record through BeanFactory::getBean() without checking the requesting user's record access. The affected flow begins at modules/AOS_PDF_Templates/generatePdf.php and uses generatePdf, and BeanFactory::getBean() to carry | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-63218 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the record-level access check enforced by DetailView. The affected flow begins at AOR_Reports and uses changeReportPage, and DetailView to carry attacker-controlled data or authoriza | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-61650 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoint checks only view and list permissions before a one-to-many relationship writes a target record's foreign key, without enforcing the required edit permission. A low-privileged user can r | High 8.1 | 5 Nov 2026 |
| CVE-2026-61651 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the get_end_date action in Projects Controller concatenates an authenticated caller's task_id value into a SQL query without parameterization. A low-privileged user can use blind SQL injection to enumerate the database schema and extract credentials, customer record | High 8.3 | 5 Nov 2026 |
| CVE-2026-61653 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $_REQUEST['id'] into SQL. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the entity-encoded backup, allowing a literal | High 8.3 | 5 Nov 2026 |
| CVE-2026-63111 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API lacks module-level authorization and permits a low-privileged user to create SchedulersJobs records with attacker-controlled target values. The affected flow begins at /Api/V8/module and uses SchedulersJobs, target, cron.php, and url:: to carry att | High 7.1 | 5 Nov 2026 |
| CVE-2026-63213 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden zip_to_dir parameter, while clean_path() does not reject traversal sequences. An authenticated administrator can copy extracted package files outside the intended destination, overwrite application or configuration fi | High 7.2 | 5 Nov 2026 |
| CVE-2026-61648 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, a user-controllable Multi report condition passes parameter_value through unencodeMultienum() and concatenates the result into a SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a proce | High 8.3 | 5 Nov 2026 |
| CVE-2026-61649 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the SSRF protection added in 7.15.1 uses a substring comparison in isSelfRequest() rather than hostname equality. The affected flow begins at validate_external_host() and uses isSelfRequest(), and stripos() to carry attacker-controlled data or authorization state in | High 7.7 | 5 Nov 2026 |
| CVE-2026-100364 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord() and uses processAttributes(), id, and ACL_ALLOW_OWNER to carry attacker-controlled data or authorization | High 7.1 | 5 Nov 2026 |
| CVE-2026-100365 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AOR_Reports and uses aor_fields, ORDER BY, and field label to carry attacker-controlled data or authorization state | High 8.8 | 5 Nov 2026 |
| CVE-2026-100360 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records. In the verified Account-to-Contact case, an authenticated user can create a relationship while unable to edit the Account and can delete rel | High 7.1 | 5 Nov 2026 |
| CVE-2026-100361 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at PATCH /Api/V8/module and uses user_hash, external_auth_only, api-visible: false, and sensitive: true t | High 7.1 | 5 Nov 2026 |
| CVE-2026-100362 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the /legacy/Api/V8/OAuth2 password-grant endpoint returns distinct error messages for an invalid username and an invalid password. An unauthenticated remote attacker can use those response differences to enumerate valid CRM usernames and target confirmed accounts wi | Medium 6.9 | 5 Nov 2026 |
| CVE-2026-100363 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The affected flow begins at /Api/V8/module and uses ACLRoles, ACLActions, and Administration to carry attacker-controlled data or authorization state into the | High 8.8 | 5 Nov 2026 |
| CVE-2026-100359 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project Template module's action_get_end_date function interpolates authenticated caller-controlled task_id and lag POST parameters directly into SQL without sanitization, parameterization, or escaping. Any authenticated user can perform blind SQL injection to r | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-100358 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom/ that is included on later page loads. An administrator can inject persistent PHP that executes as the web-server accou | Critical 9.4 | 5 Nov 2026 |
| CVE-2026-33289 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection vulnerability exists in the SuiteCRM authentication flow. The application fails to properly sanitize user-supplied input before embedding it into the LDAP search filter. By injecting LDAP control characters, an unauthenticated attacker can | High 8.8 | 20 Mar 2026 |
| CVE-2026-33288 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a SQL Injection vulnerability exists in the SuiteCRM authentication mechanisms when directory support is enabled. The application fails to properly sanitize the user-supplied username before using it in a local database query. An attacker with valid, low-pri | High 8.8 | 20 Mar 2026 |
| CVE-2026-32697 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the `RecordHandler::getRecord()` method retrieves any record by module and ID without checking the current user's ACL view permission. The companion `saveRecord()` method correctly checks `$bean->ACLAccess('save')`, but `getRecord()` skips the equivalent `ACLAccess('vi | Medium 6.5 | 20 Mar 2026 |
| CVE-2026-29108 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, an authenticated API endpoint allows any user to retrieve detailed information about any other user, including their password hash, username, and MFA configuration. As any authenticated user can query this endpoint, it's possible to retrieve and potentially crack the p | Medium 6.5 | 20 Mar 2026 |
| CVE-2026-29109 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to and including 8.9.2 contain an unsafe deserialization vulnerability in the SavedSearch filter processing component that allows an authenticated administrator to execute arbitrary system commands on the server. `FilterDefinitionProvider.php` calls `unserialize()` on user-controll | High 8.6 | 20 Mar 2026 |
| CVE-2026-29189 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL (Access Control List) checks on several endpoints, allowing authenticated users to access and manipulate data they should not have permission to interact with. Versions 7.15.1 and 8.9.3 patch the issue. | High 8.1 | 20 Mar 2026 |
| CVE-2026-29106 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the value of the return_id request parameter is copied into the value of an HTML tag attribute which is an event handler and is encapsulated in double quotation marks. Versions 7.15.1 and 8.9.3 patch the issue. Users should also use a Content Security Policy | Medium 5.9 | 19 Mar 2026 |
| CVE-2026-29107 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, it is possible to create PDF templates with `<img>` tags. When a PDF is exported using this template, the content (for example, `<img src=http://{burp_collaborator_url}>` is rendered server side, and thus a request is issued from the server, resulting in Ser | Medium 5.0 | 19 Mar 2026 |
| CVE-2026-29101 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a Denial-of-Service (DoS) vulnerability exists in SuiteCRM modules. Versions 7.15.1 and 8.9.3 patch the issue. | Medium 4.9 | 19 Mar 2026 |
| CVE-2026-29102 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an Authenticated Remote Code Execution (RCE) vulnerability exists in SuiteCRM modules. Versions 7.15.1 and 8.9.3 patch the issue. | High 7.2 | 19 Mar 2026 |
| CVE-2026-29103 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Critical Remote Code Execution (RCE) vulnerability exists in SuiteCRM 7.15.0 and 8.9.2, allowing authenticated administrators to execute arbitrary system commands. This vulnerability is a direct Patch Bypass of CVE-2024-49774. Although the vendor attempted to fix the issue in version 7.14.5, | Critical 9.1 | 19 Mar 2026 |
| CVE-2026-29104 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains an authenticated arbitrary file upload vulnerability in the Configurator module. An authenticated administrator can bypass intended file type restrictions when uploading PDF font files, allowing arbitrary files with attacker‑controlled file | Low 2.7 | 19 Mar 2026 |
| CVE-2026-29105 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains an unauthenticated open redirect vulnerability in the WebToLead capture functionality. A user-supplied POST parameter is used as a redirect destination without validation, allowing attackers to redirect victims to arbitrary external website | Medium 5.4 | 19 Mar 2026 |
| CVE-2026-29097 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions prior to 7.15.1 and 8.9.3 contain a Server-Side Request Forgery (SSRF) vulnerability combined with a Denial of Service (DoS) condition in the RSS Feed Dashlet component. Versions 7.15.1 and 8.9.3 patch the issue. | High 7.1 | 19 Mar 2026 |
| CVE-2026-29098 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `action_exportCustom` function in `modules/ModuleBuilder/controller.php` fails to properly neutralize path traversal sequences in the `$modules` and `$name` parameters. Both parameters later reach the `exportCustom` function in `modules/ModuleBuilder/MB/ | Medium 4.9 | 19 Mar 2026 |
| CVE-2026-29099 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()` function in `include/OutboundEmail/OutboundEmail.php` fails to properly neutralize the user controlled `$id` parameter. It is assumed that the function calling `retrieve()` will appropriately quote and sanitize the user input. However, two l | High 8.8 | 19 Mar 2026 |
| CVE-2026-29100 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM 7.15.0 contains a reflected HTML injection vulnerability in the login page that allows attackers to inject arbitrary HTML content, enabling phishing attacks and page defacement. Version 7.15.1 patches the issue. | High 7.1 | 19 Mar 2026 |
| CVE-2026-29096 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, when creating or editing a report (AOR_Reports module), the `field_function` parameter from POST data is saved directly into the `aor_fields` table without any validation. Later, when the report is executed/viewed, this value is concatenated directly into a | High 8.1 | 19 Mar 2026 |
| CVE-2019-18785 | SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials. | High 7.5 | 20 Mar 2020 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 24 Last 12 months 45 Lifetime Access control 35 % Injection 26 % XSS/CSRF 22 % RCE/file handling 17 % Latest advisories Loading the feed Overview SuiteCRM is the open-source successor to SugarCRM, deployed heavily across UK and European public-sector bodies and small businesses that keep citizen and customer records in it. The reference point for cost is who runs it: a council or a charity with a CRM full of named individuals and nobody watching for a compromise. Twenty-four of its forty-five published advisories arrived in the last twelve months, one of the three busiest unpaid pipelines in this category. SalesAgility takes reports through the GitHub advisory tab under a documented community policy and offers nothing in return, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy asks for private reports through the GitHub advisory tab under a published community security policy, and it draws no component boundary. The whole SuiteCRM application is in scope on both supported lines The legacy core inherited from SugarCRM Community Edition: the bean layer, the module framework and the query construction underneath it The SuiteCRM 8 front end and the API layer it talks to, which sits over that same legacy core SecuritySuite security groups and roles, the record-level access control that decides who can see which customer The REST APIs, both the legacy v4.1 service and the V8 API with its OAuth2 token model Studio and the module builder, where an administrator defines new modules and fields and the product writes PHP to disk Workflow and the scheduler, which execute stored configuration as privileged background jobs The reporting module and its filters, which build database queries from user-supplied criteria Inbound and outbound email, including the inbound email monitor that parses messages from unauthenticated senders and the campaign and mass-mail surface Record import and export, which parses user-supplied files and writes records from them File attachments and the upload directory, both the write path and the retrieval check The installer, the repair and rebuild tools and the upgrade wizard, all of which run with high privilege Authentication options in the tree, including LDAP and SAML, plus session handling and password reset The customer-facing portal surface, where an external party signs in to see their own cases Out of scope SugarCRM's commercial products, which are a different vendor's code Third-party SuiteCRM extensions and modules distributed outside the core repository Security group or role configuration an administrator chose deliberately Upstream PHP library issues, unless SuiteCRM's own use of the library is what makes the defect reachable Hosting and server configuration, including a deployment that serves the upload directory as executable Releases outside the lines the project currently supports Most-valued findings SecuritySuite bypass, where a user reads or edits a record their security groups were supposed to exclude. On a public-sector CRM this is the difference between one caseworker's caseload and everybody's Studio and the module builder, where an administrative feature writes executable PHP to disk. Administrator in this product is often a business user rather than the server operator, so that gap is a real privilege boundary SQL injection through legacy query construction, report filters, list-view search or the v4.1 API. The inherited codebase assembles queries in many places and this is the densest class in its public history The upload directory and anything that lands a file with an executable extension where the web server will run it, plus path traversal in the attachment download route The legacy v4.1 REST service, which predates the current authorisation model and is still reachable on many deployments Authentication and session defects, including password reset, SAML assertion handling and session fixation Stored cross-site scripting in a contact, case or email record that later renders in an administrator's session, since administrator reaches Studio The inbound email monitor, one of the few paths where a complete stranger's content reaches server-side parsing with no account Scheduler and workflow jobs that act on low-privilege user input while running with elevated rights Unauthorised record disclosure through the portal, where an external account already holds valid credentials Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Use the "Report a Vulnerability" tab on salesagility/SuiteCRM, the channel the SECURITY.md names Read the fuller community security policy at docs.suitecrm.com before filing; it is the more detailed document and sets the expectations triage works to Say which line you tested. SuiteCRM 7 and SuiteCRM 8 are different enough that a finding in one may not exist in the other, and 8 still carries the legacy core underneath A defect inherited from SugarCRM Community Edition code still gets reported here. SugarCRM is a separate commercial vendor and is not the maintainer of this fork Give the security group configuration your reproduction assumed. SecuritySuite record access is the product's main authorisation mechanism and a report without it cannot be reproduced There is no reward tier and no payment to negotiate Disclosure Coordinated privately through the GitHub advisory tab and published as a GitHub Security Advisory alongside a patched release. At twenty-four advisories in a year the pipeline is visibly attended, and the public record shows SalesAgility batching fixes into releases rather than shipping them one at a time. No fixed embargo length is published. Time disclosure to the release that carries the fix, and account for public-sector operators who upgrade on a procurement cycle rather than a release cycle. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability