{"id":"CVE-2026-63111","kind":"vulnerability","aliases":["CVE-2026-63111"],"related":[],"title":"SuiteCRM: low-privileged users can queue server-side jobs and requests","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API lacks module-level authorization and permits a low-privileged user to create SchedulersJobs records with attacker-controlled target values. The affected flow begins at /Api/V8/module and uses SchedulersJobs, target, cron.php, and url:: to carry attacker-controlled data or authorization state into the security-sensitive operation. Cron.php later executes the queued job with system privileges, and the url:: target makes server-side requests to internal or external hosts, can follow redirects, can persist as a recurring job, and may expose internal services. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's V8 module API lets a low-privileged user create SchedulersJobs records with attacker-chosen targets, because the endpoint lacks module-level authorization. The queued job runs with system privileges via cron.php and can make server-side requests to internal or external hosts.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","package","php","self-hosted","suitecrm"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed SuiteCRM version and compare it with `7.15.2` (7.x line) and `8.10.2` (8.x line).\n- Confirm whether the V8 API at `/Api/V8/module` is reachable by user accounts with low privileges.","fix":"- SuiteCRM 7.x: `7.15.2`\n- SuiteCRM 8.x: `8.10.2`","status":"open","published_at":"2026-11-05T19:17:23+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","triaged_at":"2026-11-05T19:43:01+00:00","updated_at":"2026-11-05T19:43:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T19:43:01Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: `7.15.2`\n- SuiteCRM 8.x: `8.10.2`","reach":"network","title":"SuiteCRM: low-privileged users can queue server-side jobs and requests","impact":"high","summary":"SuiteCRM's V8 module API lets a low-privileged user create SchedulersJobs records with attacker-chosen targets, because the endpoint lacks module-level authorization. The queued job runs with system privileges via cron.php and can make server-side requests to internal or external hosts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php","crm"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"low-privileged user runs server-side jobs and reaches internal hosts","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version and compare it with `7.15.2` (7.x line) and `8.10.2` (8.x line).\n- Confirm whether the V8 API at `/Api/V8/module` is reachable by user accounts with low privileges.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version"],"who_is_affected":"Teams running self-hosted SuiteCRM versions before 7.15.2 or 8.10.2 where users with low privileges can reach the V8 module API. Instances on patched versions are not affected by this flaw, and deployments where only trusted administrators have accounts carry less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4451,"output_tokens":562,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-63111':16A,19A '/api/v8/module':126C '7.15.2':92C,192C '8.10.2':94C,194C 'affect':122C 'api':31B,98C 'applic':89C 'attack':43B,117C,137C 'attacker-chosen':42B 'attacker-control':116C,136C 'author':53B,103C,141C 'begin':124C 'carri':135C 'chosen':44B 'control':118C,138C 'creat':38B,112C 'crm':20B,87C 'cron.php':62B,131C,149C 'custom':84C 'cve':14A,17A 'data':139C 'endpoint':48B 'enterpris':82C 'enterprise-readi':81C 'execut':151C 'expos':183C 'extern':73B,170C 'fix':189C 'flow':123C 'follow':173C 'host':25B,74B,171C 'intern':71B,168C,184C 'issu':187C 'job':11A,56B,154C,180C 'lack':49B,99C 'later':150C 'let':32B 'level':52B,102C 'low':3A,35B,108C 'low-privileg':2A,34B,107C 'make':65B,162C 'manag':86C 'may':182C 'modul':30B,51B,97C,101C 'module-level':50B,100C 'open':79C 'open-sourc':78C 'oper':148C 'packag':21B 'permit':105C 'persist':176C 'php':22B 'prior':90C 'privileg':4A,36B,60B,109C,157C 'queu':55B,153C 'queue':7A 'readi':83C 'record':40B,114C 'recur':179C 'redirect':174C 'relationship':85C 'request':13A,69B,166C 'run':57B 'schedulersjob':39B,113C,129C 'secur':146C 'security-sensit':145C 'self':24B 'self-host':23B 'sensit':147C 'server':9A,67B,164C 'server-sid':8A,66B,163C 'servic':185C 'side':10A,68B,165C 'softwar':88C 'sourc':80C 'state':142C 'suitecrm':1A,26B,27B,75C 'system':59B,156C 'target':45B,119C,130C,161C 'url':133C,160C 'use':128C 'user':5A,37B,110C 'v8':29B,96C 'valu':120C 'version':191C 'via':61B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted SuiteCRM versions before 7.15.2 or 8.10.2 where users with low privileges can reach the V8 module API. Instances on patched versions are not affected by this flaw, and deployments where only trusted administrators have accounts carry less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crm","high","package","php","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-07-31T14:29:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63111","severity":null,"published_at":"2026-11-05T19:17:23+00:00","modified_at":"2026-11-05T19:17:23+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","fetched_at":"2026-11-05T19:40:37+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79258,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-gx3x-3f4c-cjmx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-31T14:29:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}