CVE-2022-50590CWE-843

SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality

High · published November 6, 2025

CVSS v4.0
8.8
EPSS
0%
Percentile
31.8
In the wild
Unconfirmed
What it is

SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including changing the email address of the administrator.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00389 · 31.8th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2025-11-06T19:59Z
EPSS history
Timeline
  • 06 NOV 19:59Z
    SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality
    cvelistv5