CVE-2021-25961: Salesagility Suitecrm

High severity, CVSS 8.0. EPSS: 1% chance of exploitation in the next 30 days.

In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id.

Affected products

• Salesagility Suitecrm: from 7.1.7, before 7.10.32 (fixed in 7.10.32); from 7.11.0, before 7.11.21 (fixed in 7.11.21)

Published 2021-09-29. Last modified 2026-06-17.