SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify… (CVE-2026-108713)

CVE-2026-108713 describes a missing authorization vulnerability in SuiteCRM versions up to 7.15.2 and 8.x up to 8.10.2. Authenticated users can exploit the setCampaignMarketingAndTemplate entry point to create and modify EmailMarketing records without proper permission checks. Low-privileged users who lack access to Campaigns functionality can manipulate marketingId, campaignId, and templateId parameters to reattach marketing messages or alter the email templates sent by the EmailMan component in campaign emails. This vulnerability is categorized under CWE-862 (Missing Authorization).

The vulnerability allows unauthorized modification of EmailMarketing records by authenticated users with low privileges. This could lead to unauthorized changes in marketing campaigns, such as swapping email templates or reattaching marketing messages, potentially undermining campaign integrity and trust. There is no impact on confidentiality or availability, only integrity is affected. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to authenticated users and review permissions related to campaign and email marketing functionalities to limit exposure.