Authentication Bypass Vulnerability in SuiteCRM by SuiteCRM

CVE-2026-100361

What is CVE-2026-100361?

SuiteCRM, an open-source customer relationship management application, has a vulnerability that allows authenticated users to manipulate security-sensitive operations. Prior to versions 7.15.2 and 8.10.2, the V8 write path does not properly enforce metadata checks for fields, leading to scenarios where malicious users can assign internal authentication parameters and alter password hashes or authentication flags. As a result, unauthorized users may gain persistent access to accounts, posing serious security risks. The issue is resolved in the updated versions, providing essential protection against these threats.

References