# CVE-2026-69137: SuiteCRM server-url validation bypass in CalendarAccount

Source: https://junglewise.ai/threats/cve-2026-69137-suitecrm-is-an-open-source-enterprise-ready-customer-relationship  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-69137 · Severity: high · CVSS 7.7 · Published 2026-11-05

SuiteCRM is an open-source CRM application that manages customer relationships and business processes. A vulnerability in the calendar account testing feature allows authenticated attackers to pass unvalidated URLs to internal network requests, potentially exposing internal services, disclosing sensitive response data, and accessing cloud metadata from the server's context. This could enable attackers to discover and interact with internal systems that should not be directly accessible.

Technologies: [SuiteCRM](https://junglewise.ai/threats/technologies/suitecrm-suitecrm). Vendors: [SuiteCRM](https://junglewise.ai/threats/vendors/suitecrm).

## Quick answers

**Is CVE-2026-69137 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69137 being exploited in the wild.

**How severe is CVE-2026-69137?** High severity, with a CVSS score of 7.7, published 5 November 2026.

**Which products and versions are affected?** SuiteCRM prior to 7.15.2 and 8.10.2.

**Is there a fix for CVE-2026-69137?** Yes: fixed in SuiteCRM 7.15.2, 8.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69137 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-69137?** Check whether you run SuiteCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SuiteCRM 7.15.2, 8.10.2

## Technical details

The CalendarAccount::action_testConnection function passes an authenticated caller's server_url parameter directly to curl via CalDAVProvider::makeCalDAVRequest() without host, address, or scheme validation. An attacker can craft a malicious server_url to initiate PROPFIND requests from the server's network context, gaining access to internal services, enumerating service availability, and potentially accessing cloud metadata endpoints. The vulnerability affects SuiteCRM versions prior to 7.15.2 and 8.10.2.

## Affected products

- SuiteCRM SuiteCRM prior to 7.15.2 and 8.10.2

## Timeline

- 2026-11-05: disclosed
- 2026-07-31: patched: Version 8.10.2 released

## References

- [https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68](https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68)
- [https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2](https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2)

## Related threats

- [SuiteCRM SQL injection in SOAP portal API](https://junglewise.ai/threats/cve-2026-97377-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM path traversal in workflow controller](https://junglewise.ai/threats/cve-2026-71550-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM SQL injection in report query builder](https://junglewise.ai/threats/cve-2026-71548-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM SQL injection in AOR report generation](https://junglewise.ai/threats/cve-2026-69145-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM download authorization bypass in document access](https://junglewise.ai/threats/cve-2026-69144-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)