CVE-2026-100361 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's V8 API write path does not enforce hidden or sensitive field rules on PATCH requests to /Api/V8/module. An authenticated user can mass-assign internal authentication fields such as password hashes and external-auth flags, persisting unauthorized account access.
first public Oct 12, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any SuiteCRM deployment on a version before 7.15.2 or 8.10.2 that exposes the V8 REST API to logged-in users is exposed. Instances where only trusted staff have accounts and the API is not reachable from untrusted networks carry less risk, but the flaw requires only a normal authenticated account.
Not affected if api-not-exposed, patched-version
Who cares php, rest-api, self-hosted, suitecrm
/Api/V8/module7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at PATCH /Api/V8/module and uses user_hash, external_auth_only, api-visible: false, and sensitive: true to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can mass-assign internal authentication fields, modify password hashes or external-authentication flags, and persist unauthorized account access. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.