CVE-2025-54786CWE-200CWE-284CWE-287

SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data

Medium · published August 6, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
20.3
In the wild
Unconfirmed
What it is

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00288 · 20.3th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-284 · Improper Access Control; CWE-287 · Improper Authentication
Published
2025-08-06T23:23Z
EPSS history
Timeline
  • 06 AUG 23:23Z
    SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data
    cvelistv5