Sugarcrm Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://support.sugarai.com/resources/security/bug_bounty_program/
description: >-
  SugarCRM (SugarAI) runs a managed bug bounty program on HackerOne and publishes
  an RFC 9116 security.txt at the rebranded apex host. Both were verified live in
  this pass; the automated probe missed them in the prior round because it only
  checked the legacy sugarcrm.com hosts.
policy:
  - https://support.sugarai.com/resources/security/bug_bounty_program/
contact:
  - mailto:security@sugarcrm.com   # from /.well-known/security.txt
  - mailto:secure@sugarcrm.com     # program inquiries, per the bug bounty page
security_txt:
  url: https://sugarai.com/.well-known/security.txt
  file: ../well-known/sugarcrm-security.txt
  status: 200
  expires: '2027-04-01T00:00:00.000Z'
bug_bounty: true
bug_bounty_platform: HackerOne
bug_bounty_program:
  - https://hackerone.com/sugarcrm_ext
scope: >-
  Verified security bugs in Sugar products and services. Submissions are governed
  by HackerOne's Program Rules, Disclosure Guidelines and Code of Conduct plus
  SugarCRM's Terms of Use; the program is governed by California law.
safe_harbor: >-
  Not offered as safe harbor. The published program states that going public with
  a potential security vulnerability rescinds reward eligibility and may subject
  the reporter to legal action, and that SugarCRM reserves the right to involve
  law enforcement for unauthorized access.
rewards:
  published_amounts: false
  note: The program rewards eligible researchers; no reward tiers or amounts are published.
advisories:
  note: >-
    SugarCRM issues numbered security advisories (e.g. Security Advisory 2023-001
    for CVE-2023-22952) and folds security fixes into the dated product release
    notes - see changelog/sugarcrm-changelog.yml.
evidence:
  - source: https://www.sugarai.com/.well-known/security.txt
    kind: security.txt
    status: 200
    note: 'Contact: mailto:security@sugarcrm.com; Expires: 2027-04-01; Canonical: https://sugarai.com/.well-known/security.txt'
  - source: https://support.sugarai.com/resources/security/bug_bounty_program/
    kind: bug bounty page
    status: 200
    note: HackerOne-managed program; inquiries to secure@sugarcrm.com.
  - source: https://hackerone.com/sugarcrm_ext
    kind: hackerone program
    status: 200
docs:
  - https://support.sugarai.com/resources/security/bug_bounty_program/
  - https://www.sugarai.com/legal/security-trust