CVE-2022-50590
SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality
- State
- Published
- Severity
- 8.8 High
- Published
- Nov 6, 2025
- Updated
- Jul 15, 2026
- Reserved
- Nov 5, 2025
Description
SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including changing the email address of the administrator.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Affected Products
| Product | Versions |
|---|---|
SuiteCRMSuiteCRM |
|
References
- https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6vendor-advisorypatch
- https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-deleteattachment-type-confusion-vulnerability/technical-description
- https://www.vulncheck.com/advisories/suitecrm-type-confusion-via-deleteattachment-functionalitythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.