{"id":"CVE-2026-100360","kind":"vulnerability","aliases":["CVE-2026-100360"],"related":[],"title":"SuiteCRM: V8 API relationship writes skip edit and view authorization checks","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records. In the verified Account-to-Contact case, an authenticated user can create a relationship while unable to edit the Account and can delete relationship links to a hidden Contact that cannot be viewed directly. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's V8 API does not consistently check object-level edit and view permissions on both related records when writing relationships. An authenticated user can create Account-to-Contact links without edit rights on the Account and delete links to contacts they cannot view.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","package","self-hosted","suitecrm"],"not_affected_if":["no-v8-api-exposure","patched-version"],"how_to_check":"- Check the installed SuiteCRM version in the admin console or in the package metadata; versions before `7.15.2` and `8.10.2` are affected\n- Confirm whether the V8 API is reachable by user accounts (unknown from the sources whether a default setting exposes it)","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:16:57+00:00","first_seen_at":"2026-11-05T19:40:34+00:00","triaged_at":"2026-11-05T19:43:09+00:00","updated_at":"2026-11-05T19:43:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T19:43:09Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"network","title":"SuiteCRM: V8 API relationship writes skip edit and view authorization checks","impact":"medium","summary":"SuiteCRM's V8 API does not consistently check object-level edit and view permissions on both related records when writing relationships. An authenticated user can create Account-to-Contact links without edit rights on the Account and delete links to contacts they cannot view.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","crm"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users alter CRM relationships on records they cannot see or edit","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version in the admin console or in the package metadata; versions before `7.15.2` and `8.10.2` are affected\n- Confirm whether the V8 API is reachable by user accounts (unknown from the sources whether a default setting exposes it)","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-v8-api-exposure"],"who_is_affected":"Any SuiteCRM instance on a version before 7.15.2 or 8.10.2 that exposes the V8 API to logged-in users is exposed. The flaw needs an authenticated account, so instances where only trusted staff can log in carry less risk, though the sources do not say how the API is enabled by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4368,"output_tokens":577,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-100360':14A,17A '-2026':13A,16A '7.15.2':87C,151C '8.10.2':89C,153C 'account':52B,61B,114C,130C 'account-to-contact':51B,113C 'api':3A,27B,91C 'applic':84C 'authent':47B,119C 'author':10A,105C 'cannot':68B,141C 'case':117C 'check':11A,31B 'consist':30B,97C 'contact':54B,66B,116C,139C 'creat':50B,122C 'crm':18B,82C 'custom':79C 'cve':12A,15A 'delet':63B,133C 'direct':144C 'edit':7A,35B,57B,102C,128C 'enforc':98C 'enterpris':77C 'enterprise-readi':76C 'fix':148C 'hidden':138C 'host':22B 'issu':146C 'level':34B,101C 'link':55B,64B,135C 'manag':81C 'object':33B,100C 'object-level':32B,99C 'open':74C 'open-sourc':73C 'packag':19B 'path':94C 'permiss':38B 'prior':85C 'readi':78C 'record':42B,109C 'relat':41B,108C 'relationship':4A,45B,80C,92C,124C,134C 'right':58B 'self':21B 'self-host':20B 'skip':6A 'softwar':83C 'sourc':75C 'suitecrm':1A,23B,24B,70C 'unabl':126C 'user':48B,120C 'v8':2A,26B,90C 'verifi':112C 'version':150C 'view':9A,37B,69B,104C,143C 'without':56B 'write':5A,44B,93C","nicknames":[],"mitigations":[],"who_affected":"Any SuiteCRM instance on a version before 7.15.2 or 8.10.2 that exposes the V8 API to logged-in users is exposed. The flaw needs an authenticated account, so instances where only trusted staff can log in carry less risk, though the sources do not say how the API is enabled by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crm","high","package","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-10-12T17:46:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100360","severity":null,"published_at":"2026-11-05T19:16:57+00:00","modified_at":"2026-11-05T19:16:57+00:00","first_seen_at":"2026-11-05T19:40:34+00:00","fetched_at":"2026-11-05T19:40:34+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79149,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-6jf7-hh5p-8fcm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-12T17:46:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}