Sugar Serve 14.0.4 Release Notes

Overview

This document describes the changes and functionality available in Sugar 14.0.4. Sugar 14.0.4 is only available for customers on the annual upgrade path.

Fixed Issues

Sugar 14.0.4 is a security update released to address certain security vulnerabilities identified during our routine QA checks.

For customers on the annual upgrade path, we strongly recommend that you install this update at the earliest opportunity. While we have not experienced any reported incidents relating to these vulnerabilities to date, failure to install this update could leave you exposed to malicious third-party attacks. For more information, please click the link below to expand or collapse the Security Advisories.

Security Advisories

Security Advisory sugarcrm-sa-2026-001: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-002: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-003: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-004: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-005: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-006: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-007: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-008: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-009: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-010: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-011: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-012: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-013: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-014: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-015: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-016: A Cross-Site Request Forgery issue impacting regular users was identified. The Cross-Site Request Forgery issue has been fixed.
Security Advisory sugarcrm-sa-2026-017: A Cross-Site Scripting issue impacting admin users was identified. The Cross-Site Scripting issue has been fixed.
Security Advisory sugarcrm-sa-2026-018: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-019: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-020: A HTTP Host Header Injection issue impacting any user was identified. The HTTP Host Header Injection issue has been fixed.
Security Advisory sugarcrm-sa-2026-021: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-022: A Cross-Site Request Forgery issue impacting admin users was identified. The Cross-Site Request Forgery issue has been fixed.
Security Advisory sugarcrm-sa-2026-023: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-024: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-025: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-026: A Privilege Escalation issue impacting regular users was identified. The Privilege Escalation issue has been fixed.
Security Advisory sugarcrm-sa-2026-027: A Broken Access Control issue impacting regular users was identified. The Broken Access Control issue has been fixed.
Security Advisory sugarcrm-sa-2026-028: A Regular Expression Denial of Service issue impacting any user was identified. The Regular Expression Denial of Service issue has been fixed.
Security Advisory sugarcrm-sa-2026-029: A Regular Expression Denial of Service issue impacting any user was identified. The Regular Expression Denial of Service issue has been fixed.
Security Advisory sugarcrm-sa-2026-030: A Use of Hard-coded Credentials issue impacting any user was identified. The Use of Hard-coded Credentials issue has been fixed.

These vulnerabilities have been addressed in release 14.0.4, which is available for download from the Download Manager.

Administrators are strongly encouraged to upgrade their on-site Sugar instances running 14.0.3 or lower to version 14.0.4 to prevent potential exploitation of these weaknesses.

The following issues have been resolved in this release:

In certain circumstances, accessing the activity stream view from a module's list view (e.g., Cases) resulted in a 500 error. This issue has been fixed, and users can now access the Activity Stream in the module's list view as expected.
Repeat-type fields in Meetings did not respect the field-level permissions set for a role. The field-level permissions set for Repeat-type fields are now respected properly in Sugar.
Certain SugarIdentity-enabled instances experienced premature expiration of access and refresh tokens, which caused unexpected issues such as user session timeouts and HTTP errors. This issue has been resolved, and the access and refresh tokens no longer expire prematurely.

Supported Platforms

For information on supported platform components, see Sugar 14.0.x Supported Platforms.