{"id":"CVE-2026-61650","kind":"vulnerability","aliases":["CVE-2026-61650"],"related":[],"title":"SuiteCRM: low-privileged users can reassign records they should not edit","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoint checks only view and list permissions before a one-to-many relationship writes a target record's foreign key, without enforcing the required edit permission. A low-privileged user can reassign records, alter ownership and security-relevant relationships, expand cross-user access, and manipulate workflows. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's V8 relationships API checks only view and list permissions before writing a foreign key on a target record. An authenticated low-privileged user can therefore reassign records, change ownership and relationships, and widen access to other users' data.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","package","php","self-hosted","suitecrm"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the installed SuiteCRM version in the application's version file or admin panel and compare it with the fixed versions below.\n- Confirm whether the instance exposes the `/Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName}` endpoint to non-admin users.","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:17:22+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","triaged_at":"2026-11-05T19:42:53+00:00","updated_at":"2026-11-05T19:42:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T19:42:53Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"network","title":"SuiteCRM: low-privileged users can reassign records they should not edit","impact":"medium","summary":"SuiteCRM's V8 relationships API checks only view and list permissions before writing a foreign key on a target record. An authenticated low-privileged user can therefore reassign records, change ownership and relationships, and widen access to other users' data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php","crm"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"low-privileged user reassigns records and expands access to others' data","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version in the application's version file or admin panel and compare it with the fixed versions below.\n- Confirm whether the instance exposes the `/Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName}` endpoint to non-admin users.","plain_action":"","needs_analyst":false,"not_affected_if":["auth-required","managed-hosting"],"who_is_affected":"Any SuiteCRM instance before 7.15.2 or 8.10.2 that lets low-privileged accounts use the V8 API is exposed. The flaw needs a valid user account, so instances with only admin users or without API access are less exposed. Teams that run a hosted SuiteCRM service should check with the provider.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4399,"output_tokens":576,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-61650':15A,18A '/api/v8/module':89C '/relationships':92C '7.15.2':84C,150C '8.10.2':86C,152C 'access':62B,140C 'alter':129C 'api':30B 'applic':81C 'authent':47B 'chang':56B 'check':31B,95C 'crm':19B,79C 'cross':138C 'cross-us':137C 'custom':76C 'cve':13A,16A 'data':66B 'edit':12A,119C 'endpoint':94C 'enforc':116C 'enterpris':74C 'enterprise-readi':73C 'expand':136C 'fix':147C 'foreign':40B,113C 'host':24B 'id':91C 'issu':145C 'key':41B,114C 'linkfieldnam':93C 'list':35B,99C 'low':3A,49B,123C 'low-privileg':2A,48B,122C 'manag':78C 'mani':106C 'manipul':142C 'modulenam':90C 'one':104C 'one-to-mani':103C 'open':71C 'open-sourc':70C 'ownership':57B,130C 'packag':20B 'permiss':36B,100C,120C 'php':21B 'post':88C 'prior':82C 'privileg':4A,50B,124C 'readi':75C 'reassign':7A,54B,127C 'record':8A,45B,55B,111C,128C 'relationship':29B,59B,77C,107C,135C 'relev':134C 'requir':118C 'secur':133C 'security-relev':132C 'self':23B 'self-host':22B 'softwar':80C 'sourc':72C 'suitecrm':1A,25B,26B,67C 'target':44B,110C 'therefor':53B 'user':5A,51B,65B,125C,139C 'v8':28B 'version':149C 'view':33B,97C 'widen':61B 'without':115C 'workflow':143C 'write':38B,108C","nicknames":[],"mitigations":[],"who_affected":"Any SuiteCRM instance before 7.15.2 or 8.10.2 that lets low-privileged accounts use the V8 API is exposed. The flaw needs a valid user account, so instances with only admin users or without API access are less exposed. Teams that run a hosted SuiteCRM service should check with the provider.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crm","high","package","php","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-07-31T14:16:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61650","severity":null,"published_at":"2026-11-05T19:17:22+00:00","modified_at":"2026-11-05T19:17:22+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","fetched_at":"2026-11-05T19:40:37+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79243,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-qmh9-m7g7-pxxp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-31T14:16:10+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}