CVE-2025-54786
Published: 07 August 2025
Summary
CVE-2025-54786 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Salesagility Suitecrm. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Discovery (T1087); ranked at the 39.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23891
Vulnerability details
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event)…
more
data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated user enumeration enables T1087 (Account Discovery). Unauthenticated access to CRM meeting/calendar data enables T1213.004 (Data from Information Repositories: Customer Relationship Management Software).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Literacy training teaches users to recognize and avoid actions that result in unauthorized exposure of sensitive information.
Session auditing enables detection of unauthorized exposure or access to sensitive information during user activities.
Audit record review and analysis can detect unauthorized exposure or access to sensitive information.
Penetration testing simulates unauthorized access attempts, directly detecting and enabling remediation of improper access control weaknesses.
The integrated analysis team enables faster detection and containment of incidents involving unauthorized exposure of sensitive information, limiting attacker success in exploiting such weaknesses.
Architectures explicitly define requirements and mechanisms for access control to protect confidentiality, integrity, and availability.
Trained staff understand data-handling requirements and are less likely to expose sensitive information through misconfiguration or poor design.
Threat hunting directly searches for indicators of unauthorized access or control violations that bypassed preventive mechanisms.