SugarCRM versions 6.5.18 and below suffer from a missing authorization check vulnerability.