CVE-2025-54786: SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-07 · updated 2026-06-17
Weakness: CWE-200

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1.

Affected products

salesagility SuiteCRM: 7.14.6, 8.8.0

References

https://docs.suitecrm.com/8.x/admin/releases/8.8
https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-rf2v-4mv3-qcgm

Get alerted when CVE-2025-54786 or the next vulnerability affects your stack