PatchTheCVECVE-2022-50590: SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’
CVE-2022-50590 is a medium-severity flaw (CVSS 5.3) affecting suitecrm. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including changing the email address of the administrator.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 67%) |
| CISA exploited list | No |
| Weakness | CWE-843 |
| Published | 2025-11-06 |
| Last modified | 2026-07-15 |
Last updated 2026-07-15 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-50590?
suitecrm: upgrade to 7.12.6. Exact commands for each OS are on this page.
Is CVE-2022-50590 being exploited?
CVE-2022-50590 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-50590 affect?
CVE-2022-50590 affects suitecrm. Severity is medium (CVSS 5.3). SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter d
How urgent is CVE-2022-50590?
Priority 32/100. Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-41384 MEDIUM 6.1 DOWNGRADE Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1
- CVE-2019-25663 HIGH 7.1 UPGRADE SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate datab
- CVE-2019-25664 HIGH 7.1 UPGRADE SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module
- CVE-2022-50589 CRITICAL 9.8 UPGRADE SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ par
- CVE-2026-33289 HIGH 8.8 UPGRADE SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application