Authorization Flaw in SuiteCRM’s V8 Module API Allows User-Defined Scheduler Job Creation
CVE-2026-63111
7.1HIGH
What is CVE-2026-63111?
The V8 module API of SuiteCRM, an open-source CRM application, has a vulnerability that allows low-privileged users to create SchedulerJobs with attacker-controlled parameters. This issue is rooted in the lack of module-level authorization, enabling adversaries to execute potentially harmful commands via the cron.php process. The exploitation of this flaw can lead to unauthorized access to internal services, execute redirects, and maintain recurring jobs, posing significant risks. This vulnerability is addressed in versions 7.15.2 and 8.10.2.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2