OAuth2 Endpoint Vulnerability in SuiteCRM Open-Source Software
CVE-2026-100362
What is CVE-2026-100362?
The SuiteCRM application, an open-source enterprise Customer Relationship Management software, has a vulnerability in its OAuth2 password-grant endpoint. Prior to versions 7.15.2 and 8.10.2, this endpoint disclosed distinct error messages based on invalid credentials. This characteristic allows an unauthenticated remote attacker to differentiate between invalid usernames and invalid passwords, facilitating the enumeration of valid user accounts. Such an attack could lead to further targeted attacks, including password spraying, credential stuffing, brute-force attempts, or social engineering. Users are recommended to upgrade to the latest versions to mitigate these risks. For more information, refer to the security advisory.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2