CVE-2026-100360 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's V8 API does not consistently check object-level edit and view permissions on both related records when writing relationships. An authenticated user can create Account-to-Contact links without edit rights on the Account and delete links to contacts they cannot view.
first public Oct 12, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any SuiteCRM instance on a version before 7.15.2 or 8.10.2 that exposes the V8 API to logged-in users is exposed. The flaw needs an authenticated account, so instances where only trusted staff can log in carry less risk, though the sources do not say how the API is enabled by default.
Not affected if no-v8-api-exposure, patched-version
Who cares crm, self-hosted, suitecrm
7.15.2 and 8.10.2 are affected7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records. In the verified Account-to-Contact case, an authenticated user can create a relationship while unable to edit the Account and can delete relationship links to a hidden Contact that cannot be viewed directly. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.