{"id":"CVE-2026-100364","kind":"vulnerability","aliases":["CVE-2026-100364"],"related":[],"title":"SuiteCRM: authenticated users can overwrite and take over other users' records","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord() and uses processAttributes(), id, and ACL_ALLOW_OWNER to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can substitute a victim record identifier, bypass owner-only authorization, overwrite another record, and hijack record ownership. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's V8 JSON:API update path does not strip the record id before assigning user-supplied attributes, so a logged-in user can point an update at another person's record. An attacker can overwrite that record and take ownership of it.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","package","self-hosted","suitecrm"],"not_affected_if":["api-disabled","auth-required","patched-version"],"how_to_check":"- Check the installed SuiteCRM version in the application's version file or admin panel, and compare it with the fixed versions below.\n- Confirm whether the V8 JSON:API is enabled and reachable by logged-in users.","fix":"- SuiteCRM 7.x: upgrade to `7.15.2`\n- SuiteCRM 8.x: upgrade to `8.10.2`","status":"open","published_at":"2026-11-05T19:16:58+00:00","first_seen_at":"2026-11-05T19:40:34+00:00","triaged_at":"2026-11-05T19:43:11+00:00","updated_at":"2026-11-05T19:43:11+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T19:43:11Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: upgrade to `7.15.2`\n- SuiteCRM 8.x: upgrade to `8.10.2`","reach":"network","title":"SuiteCRM: authenticated users can overwrite and take over other users' records","impact":"medium","summary":"SuiteCRM's V8 JSON:API update path does not strip the record id before assigning user-supplied attributes, so a logged-in user can point an update at another person's record. An attacker can overwrite that record and take ownership of it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","crm"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user overwrites and takes over other users' CRM records","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version in the application's version file or admin panel, and compare it with the fixed versions below.\n- Confirm whether the V8 JSON:API is enabled and reachable by logged-in users.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","api-disabled","auth-required"],"who_is_affected":"Self-hosted SuiteCRM instances on versions before 7.15.2 or 8.10.2 that expose the V8 JSON:API to users with accounts. The attacker must already have a valid user login. Instances that do not use the V8 API or restrict it to trusted users are at lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000717,"input_tokens":4427,"output_tokens":549,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-100364':14A,17A '-2026':13A,16A '7.15.2':84C,164C '8.10.2':86C,166C 'acl':119C 'affect':109C 'allow':120C 'anoth':54B,152C 'api':28B,90C 'applic':81C 'assign':38B,100C 'attack':59B,125C 'attacker-control':124C 'attribut':42B,98C,104C 'authent':2A,138C 'author':129C,150C 'begin':111C 'bypass':146C 'carri':123C 'control':126C 'crm':18B,79C 'custom':76C 'cve':12A,15A 'data':127C 'enterpris':74C 'enterprise-readi':73C 'fail':93C 'fix':161C 'flow':110C 'hijack':155C 'host':22B 'id':36B,97C,117C 'identifi':145C 'issu':159C 'json':27B,89C 'log':46B 'logged-in':45B 'manag':78C 'open':71C 'open-sourc':70C 'oper':136C 'overwrit':5A,61B,151C 'owner':121C,148C 'owner-on':147C 'ownership':66B,157C 'packag':19B 'path':30B,92C 'person':55B 'point':50B 'prior':82C 'processattribut':116C 'readi':75C 'record':11A,35B,57B,63B,144C,153C,156C 'relationship':77C 'remov':95C 'secur':134C 'security-sensit':133C 'self':21B 'self-host':20B 'sensit':135C 'softwar':80C 'sourc':72C 'state':130C 'strip':33B 'substitut':141C 'sugarbean':107C 'suitecrm':1A,23B,24B,67C 'suppli':41B,103C 'take':7A,65B 'updat':29B,52B,91C 'updaterecord':113C 'use':115C 'user':3A,10A,40B,48B,102C,139C 'user-suppli':39B,101C 'v8':26B,88C 'version':163C 'victim':143C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted SuiteCRM instances on versions before 7.15.2 or 8.10.2 that expose the V8 JSON:API to users with accounts. The attacker must already have a valid user login. Instances that do not use the V8 API or restrict it to trusted users are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crm","high","package","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-10-12T17:46:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100364","severity":null,"published_at":"2026-11-05T19:16:58+00:00","modified_at":"2026-11-05T19:16:59+00:00","first_seen_at":"2026-11-05T19:40:34+00:00","fetched_at":"2026-11-05T19:40:34+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79169,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-8rjm-vpj3-hch8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-12T17:46:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}