SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated… (CVE-2026-108712)

The vulnerability in SuiteCRM through versions 7.15.2 and 8.10.2 is due to missing authorization checks in the DetailUserRole entry point. Authenticated non-admin users can exploit this by providing another non-admin user's ID in the record parameter, enabling them to read that user's assigned roles and per-module ACL action matrix. This exposure leaks access control information but does not allow modification or denial of service.

The impact is limited to confidentiality as attackers can view ACL data of other non-admin users. There is no impact on integrity or availability. This could potentially aid attackers in understanding user permissions but does not directly allow privilege escalation or data modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to authenticated users and monitor for suspicious activity related to unauthorized ACL data access.