{"id":"CVE-2022-50590","summary":"SuiteCRM \u003c 7.12.6 Type Confusion via 'deleteAttachment' Functionality","details":"SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including changing the email address of the administrator.","modified":"2026-08-27T04:01:57.937047138Z","published":"2025-11-06T19:59:36.078Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-843"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50590.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50590.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50590"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/suitecrm-type-confusion-via-deleteattachment-functionality"},{"type":"FIX","url":"https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6"},{"type":"PACKAGE","url":"https://github.com/SuiteCRM/SuiteCRM"},{"type":"ARTICLE","url":"https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-deleteattachment-type-confusion-vulnerability/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/suitecrm/suitecrm","events":[{"introduced":"0"},{"fixed":"51e182b29271876a9518bcef0c5c313c4a273954"}],"database_specific":{"cpe":"cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"7.12.6"}],"source":["AFFECTED_FIELD","CPE_RANGE"]}}],"versions":["v7.12.5","v7.12.4","v7.12.3","v7.12.2","v7.12.1","v7.12.0","v7.12-rc","v7.11.18","v7.11.17","v7.11.16","v7.11.15","v7.11.14","v7.11.13","v7.11.12","v7.11.11","v7.11.8","v7.11.7","v7.11.6","v7.11.5","v7.11.4","v7.11.3","v7.11.2","v7.10.12","v7.11.1","v7.11.0","v7.10.11","v7.10.10","v7.10.5","v7.10.7","v7.10.4","v7.10.6","v7.10.1","v7.10.3","v7.10.2","v7.10.0","v7.9.14","v7.9.13","v7.9.12","v7.9.11","v.7.9.11","v7.9.10","v7.9.8","v7.9.4","7.9.6","v7.9.5","v7.9.3","v7.9.1","v7.9.0","v7.9.0-rc","v7.9.0-beta","v7.8.2","v7.8.1","v7.8.0","v7.8.0-rc","v7.8.0-beta.2","v7.8.0-beta","v7.7.4","v7.7.3","v7.7.2","v7.7","v7.7-rc2","v7.7-rc","v7.7-beta2","v7.7-beta1","v7.6.1","v7.6","v7.5.1","v7.5-beta.2","v7.4.3","v7.5-beta","v7.4.1","v7.4.2","v7.3.2","v7.3.1","v7.3","v7.3-beta","v7.2","v7.2.1","v7.1.3","v7.2beta2","v7.1.4","v7.2beta","v7.1.2","v7.1.1","v7.1","v7.0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50590.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"}]}