Is CVE-2026-69137 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-69137 being exploited in the wild.

How severe is CVE-2026-69137?

High severity, with a CVSS score of 7.7, published 5 November 2026.

Which products and versions are affected?

SuiteCRM prior to 7.15.2 and 8.10.2.

Is there a fix for CVE-2026-69137?

Yes: fixed in SuiteCRM 7.15.2, 8.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-69137 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-69137?

Check whether you run SuiteCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-69137: SuiteCRM server-url validation bypass in CalendarAccount

CVE-2026-69137 · Severity: high · CVSS 7.7 · Published 2026-11-05

SuiteCRM is an open-source CRM application that manages customer relationships and business processes. A vulnerability in the calendar account testing feature allows authenticated attackers to pass unvalidated URLs to internal network requests, potentially exposing internal services, disclosing sensitive response data, and accessing cloud metadata from the server's context. This could enable attackers to discover and interact with internal systems that should not be directly accessible.

Technologies: SuiteCRM. Vendors: SuiteCRM.

Quick answers

Is CVE-2026-69137 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-69137 being exploited in the wild.
How severe is CVE-2026-69137?: High severity, with a CVSS score of 7.7, published 5 November 2026.
Which products and versions are affected?: SuiteCRM prior to 7.15.2 and 8.10.2.
Is there a fix for CVE-2026-69137?: Yes: fixed in SuiteCRM 7.15.2, 8.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69137 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-69137?: Check whether you run SuiteCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: SuiteCRM 7.15.2, 8.10.2

Technical details

The CalendarAccount::action_testConnection function passes an authenticated caller's server_url parameter directly to curl via CalDAVProvider::makeCalDAVRequest() without host, address, or scheme validation. An attacker can craft a malicious server_url to initiate PROPFIND requests from the server's network context, gaining access to internal services, enumerating service availability, and potentially accessing cloud metadata endpoints. The vulnerability affects SuiteCRM versions prior to 7.15.2 and 8.10.2.

Affected products

SuiteCRM SuiteCRM prior to 7.15.2 and 8.10.2

Timeline

2026-11-05: disclosed
2026-07-31: patched: Version 8.10.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.