Summary

The RecordHandler::getRecord() method retrieves any record by module and ID without checking the current user's ACL view permission. The companion saveRecord() method correctly checks $bean->ACLAccess('save'), but getRecord() skips the equivalent ACLAccess('view') check.

Impact

Any authenticated user (ROLE_USER) can read ANY record from ANY module by requesting:

• REST: GET /api/record/{id}?module={module}
• GraphQL: query with module and record ID

This bypasses SuiteCRM's ACL system (Security Groups, Roles, Team-based access) for read operations while write operations are correctly protected.