sugarcrm-sa-2026-024

Summary

Advisory ID: sugarcrm-sa-2026-024

Risk Level: Medium

Vulnerability: Broken Access Control

Description

A Broken Access Control vulnerability has been identified in the Contacts module. This issue could have allowed users to delete profile pictures of records they do not own. Regular users could have exploited this vulnerability by making unauthorized API requests.

We have not experienced any reports related to this vulnerability.

Affected Products

The list of affected products reflects all currently maintained versions at the publication date of this advisory. If you are running older versions than the ones reported below, we strongly advise upgrading immediately to one of the supported versions.

Upgrades

On-Site Customers

It is strongly recommended to upgrade the affected products to the reported fixed release version. SugarCRM maintains different releases of its products, each with specific upgrade paths. Refer to the Installation and Upgrade Guide specific to your Sugar version and product to patch your instance. Contact Sugar Support for any further inquiries regarding upgrades.

SugarCloud Customers

For SugarCloud customers, this security fix has already been deployed to your instance. No action is required on your part.

Workaround

There is no workaround available for this vulnerability.

Publication History

A stand-alone copy of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. SugarCRM reserves the right to change or update this document at any time.