Log in Start free

Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M

CVE-2026-100360SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record

High 7.1

In plain English

A high-severity missing authorization in SuiteCRM from SuiteCRM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.4%top 71.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records. In the verified Account-to-Contact case, an authenticated user can create a relationship while unable to edit the Account and can delete relationship links to a hidden Contact that cannot be viewed directly. This issue is fixed in versions 7.15.2 and 8.10.2.

Affected products (as reported)

VendorProductVersions
SuiteCRM SuiteCRM < 7.15.2>= 8.0.0, < 8.10.2

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

References