API Vulnerability in SuiteCRM Exposes Administrator Functions to Authenticated Users
CVE-2026-100363
8.8HIGH
What is CVE-2026-100363?
SuiteCRM, an open-source CRM application, exhibits a vulnerability where its V8 module API permits any authenticated OAuth2 user to execute CRUD operations intended solely for administrator-only modules. This flaw arises from improper management of access control lists and allows low-privileged users to manipulate roles and configurations, potentially gaining administrator-level access to sensitive CRM data and functionalities. This vulnerability has been addressed in versions 7.15.2 and 8.10.2.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2