{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T15:31:35.145","vulnerabilities":[{"cve":{"id":"CVE-2026-29189","sourceIdentifier":"security-advisories@github.com","published":"2026-03-20T00:16:16.303","lastModified":"2026-06-17T10:29:44.880","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL (Access Control List) checks on several endpoints, allowing authenticated users to access and manipulate data they should not have permission to interact with. Versions 7.15.1 and 8.9.3 patch the issue."},{"lang":"es","value":"SuiteCRM es una aplicación de software de gestión de relaciones con clientes (CRM) de código abierto y lista para empresas. Antes de las versiones 7.15.1 y 8.9.3, la API REST V8 de SuiteCRM carece de comprobaciones de ACL (Lista de Control de Acceso) en varios puntos finales, lo que permite a los usuarios autenticados acceder y manipular datos con los que no deberían tener permiso para interactuar. Las versiones 7.15.1 y 8.9.3 parchean el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"SuiteCRM","product":"SuiteCRM","versions":[{"version":"< 7.15.1","status":"affected"},{"version":">= 8.0.0, < 8.9.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-20T14:59:25.962953Z","id":"CVE-2026-29189","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:*","versionEndExcluding":"7.15.1","matchCriteriaId":"73648654-E7F6-47CF-8E01-19BBFF737C99"},{"vulnerable":true,"criteria":"cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.9.3","matchCriteriaId":"C7E15DD3-A934-40A2-8B43-ABCCBB53CBCF"}]}]}],"references":[{"url":"https://docs.suitecrm.com/admin/releases/7.15.x","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-m6x8-3hxp-qxwv","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}