{"id":"CVE-2026-100361","kind":"vulnerability","aliases":["CVE-2026-100361"],"related":[],"title":"SuiteCRM: authenticated users can overwrite password hashes via API","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at PATCH /Api/V8/module and uses user_hash, external_auth_only, api-visible: false, and sensitive: true to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can mass-assign internal authentication fields, modify password hashes or external-authentication flags, and persist unauthorized account access. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's V8 API write path does not enforce hidden or sensitive field rules on PATCH requests to /Api/V8/module. An authenticated user can mass-assign internal authentication fields such as password hashes and external-auth flags, persisting unauthorized account access.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","rest-api","self-hosted","suitecrm"],"not_affected_if":["api-not-exposed","patched-version"],"how_to_check":"- Find the installed SuiteCRM version and compare it to the fixed versions below\n- Check whether the instance exposes the V8 REST API at `/Api/V8/module`\n- Review which user accounts can authenticate against the instance","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:16:57+00:00","first_seen_at":"2026-11-05T19:40:34+00:00","triaged_at":"2026-11-05T19:43:07+00:00","updated_at":"2026-11-05T19:43:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T19:43:07Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"internet","title":"SuiteCRM: authenticated users can overwrite password hashes via API","impact":"high","summary":"SuiteCRM's V8 API write path does not enforce hidden or sensitive field rules on PATCH requests to /Api/V8/module. An authenticated user can mass-assign internal authentication fields such as password hashes and external-auth flags, persisting unauthorized account access.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php","rest-api"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker persists unauthorized account access by overwriting password hashes","analyst_note":"","how_to_check":"- Find the installed SuiteCRM version and compare it to the fixed versions below\n- Check whether the instance exposes the V8 REST API at `/Api/V8/module`\n- Review which user accounts can authenticate against the instance","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","api-not-exposed"],"who_is_affected":"Any SuiteCRM deployment on a version before 7.15.2 or 8.10.2 that exposes the V8 REST API to logged-in users is exposed. Instances where only trusted staff have accounts and the API is not reachable from untrusted networks carry less risk, but the flaw requires only a normal authenticated account.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000733,"input_tokens":4436,"output_tokens":578,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-100361':12A,15A '-2026':11A,14A '/api/v8/module':43B,119C '7.15.2':84C,178C '8.10.2':86C,180C 'access':66B,171C 'account':65B,170C 'affect':114C 'api':9A,20B,28B,101C,128C 'api-vis':100C,127C 'applic':81C 'assign':50B,155C 'attack':137C 'attacker-control':136C 'auth':61B,125C 'authent':2A,45B,52B,150C,157C,165C 'author':141C 'begin':116C 'carri':135C 'check':91C 'control':138C 'crm':79C 'custom':76C 'cve':10A,13A 'data':139C 'enforc':33B,99C 'enterpris':74C 'enterprise-readi':73C 'exist':95C 'extern':60B,124C,164C 'external-auth':59B 'external-authent':163C 'fals':130C 'field':37B,53B,94C,110C,158C 'fix':175C 'flag':62B,166C 'flow':115C 'hash':7A,57B,123C,161C 'hidden':34B 'hide':107C 'host':23B 'intern':51B,156C 'issu':173C 'manag':78C 'mass':49B,154C 'mass-assign':48B,153C 'metadata':105C 'modifi':159C 'open':71C 'open-sourc':70C 'oper':148C 'overwrit':5A 'packag':16B 'password':6A,56B,160C 'patch':40B,118C 'path':30B,90C 'persist':63B,168C 'php':17B 'prior':82C 'read':112C 'readi':75C 'relationship':77C 'request':41B 'rest':19B 'rest-api':18B 'rule':38B 'secur':146C 'security-sensit':145C 'self':22B 'self-host':21B 'sensit':36B,104C,132C,147C 'softwar':80C 'sourc':72C 'state':142C 'suitecrm':1A,24B,25B,67C 'true':133C 'unauthor':64B,169C 'use':121C 'user':3A,46B,122C,151C 'v8':27B,88C 'version':177C 'via':8A 'visibl':102C,129C 'write':29B,89C","nicknames":[],"mitigations":[],"who_affected":"Any SuiteCRM deployment on a version before 7.15.2 or 8.10.2 that exposes the V8 REST API to logged-in users is exposed. Instances where only trusted staff have accounts and the API is not reachable from untrusted networks carry less risk, but the flaw requires only a normal authenticated account.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","php","restapi","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-10-12T17:46:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100361","severity":null,"published_at":"2026-11-05T19:16:57+00:00","modified_at":"2026-11-05T19:16:57+00:00","first_seen_at":"2026-11-05T19:40:34+00:00","fetched_at":"2026-11-05T19:40:34+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79154,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-jhhh-64wx-fj9c","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-12T17:46:01+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}