# CVE-2022-50590: SalesAgility SuiteCRM type confusion in deleteAttachment

Source: https://junglewise.ai/threats/cve-2022-50590-salesagility-suitecrm-type-confusion-in-deleteattachment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-06. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2022-50590 · Severity: medium · CVSS 5.3 · Published 2025-11-06

SuiteCRM, a popular open-source customer relationship management platform, contains a security flaw in how it handles file attachment deletions. An unauthenticated attacker can exploit this to modify sensitive database information, such as changing the administrator's email address. This could lead to a full takeover of the CRM system and unauthorized access to customer data.

Technologies: [Salesagility Suitecrm](https://junglewise.ai/threats/technologies/suitecrm). Vendors: [Salesagility](https://junglewise.ai/threats/vendors/salesagility).

## Quick answers

**Is CVE-2022-50590 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-50590 being exploited in the wild.

**How severe is CVE-2022-50590?** Medium severity, with a CVSS score of 5.3, published 6 November 2025.

**Which products and versions are affected?** Salesagility Suitecrm < 7.12.6.

**Is there a fix for CVE-2022-50590?** A patch was published on 2022-06-09: Vendor release of version 7.12.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-50590 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2022-50590?** Check whether you run Salesagility Suitecrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A type confusion vulnerability (CWE-843) exists in SuiteCRM within the processing of the 'module' parameter of the 'deleteAttachment' function. The root cause is the application's failure to properly validate or enforce expected types when handling this parameter, allowing an attacker to manipulate the logic of database interactions. A remote, unauthenticated attacker can exploit this over the network to alter arbitrary database objects. Demonstrated impacts include the ability to change the administrator's email address, which can facilitate account takeover. The issue is resolved in SuiteCRM version 7.12.6.

## Affected products

- SalesAgility SuiteCRM < 7.12.6

## Timeline

- 2022-03-02: disclosed: Disclosed to vendor
- 2022-06-09: advisory: Public disclosure by Exodus Intelligence
- 2022-06-09: patched: Vendor release of version 7.12.6

## References

- [https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-deleteattachment-type-confusion-vulnerability/](https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-deleteattachment-type-confusion-vulnerability/)
- [https://docs.suitecrm.com/admin/releases/7.12.x/](https://docs.suitecrm.com/admin/releases/7.12.x/)
- [https://www.vulncheck.com/advisories/suitecrm-type-confusion-via-deleteattachment-functionality](https://www.vulncheck.com/advisories/suitecrm-type-confusion-via-deleteattachment-functionality)

## Related threats

- [SuiteCRM SQL injection in Users module record parameter](https://junglewise.ai/threats/cve-2019-25664-suitecrm-sql-injection-in-users-module-record-parameter)
- [SuiteCRM SQL injection in Emails module via parentTab parameter](https://junglewise.ai/threats/cve-2019-25663-suitecrm-sql-injection-in-emails-module-via-parenttab-parameter)
- [SalesAgility SuiteCRM SQL injection in export functionality](https://junglewise.ai/threats/cve-2022-50589-salesagility-suitecrm-sql-injection-in-export-functionality)
- [Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to…](https://junglewise.ai/threats/cve-2025-41384-cross-site-scripting-xss-vulnerability-reflected-in-suitecrm-v7)