Exploitable Permissions Issue in SuiteCRM Affects Record Management

CVE-2026-61650

What is CVE-2026-61650?

SuiteCRM, an open-source CRM application, has a vulnerability in the API endpoint that handles one-to-many relationships. Specifically, prior to version 7.15.2 and 8.10.2, the system inadequately checks edit permissions, allowing low-privileged users to bypass restrictions. This flaw permits unauthorized reassignment of records, modification of ownerships, and manipulation of security-sensitive relationships. Consequently, it expands cross-user access and disrupts workflow integrity. Users are advised to update to the patched versions to mitigate these risks.

References