CVE-2026-100361 in SuiteCRM
Summary
by MITRE • 11/05/2026
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at PATCH /Api/V8/module and uses user_hash, external_auth_only, api-visible: false, and sensitive: true to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can mass-assign internal authentication fields, modify password hashes or external-authentication flags, and persist unauthorized account access. This issue is fixed in versions 7.15.2 and 8.10.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
SuiteCRM serves as a widely deployed open-source Customer Relationship Management platform designed to manage customer interactions and business processes for enterprises of varying sizes. The software architecture relies on robust security mechanisms to protect sensitive user data, including authentication credentials and internal configuration states. However, prior to versions 7.15.2 and 8.10.2, a critical architectural flaw existed within the V8 API write path that undermined these security controls. This vulnerability stems from an incomplete implementation of access control checks during object persistence operations, specifically affecting how field-level metadata is validated against user permissions and data visibility rules.
The technical root cause lies in the disparity between read-time and write-time validation logic. When a client submits a PATCH request to the /Api/V8/module endpoint, the application verifies that the requested fields exist within the module schema but fails to enforce critical security attributes associated with those fields. Specifically, the system does not check whether a field is marked as api-visible: false or sensitive: true before allowing it to be written by an authenticated user. In standard secure implementations, these metadata flags are designed to restrict access; api-visible: false typically prevents data from being returned in read operations, while sensitive: true often implies that the field contains high-value secrets such as password hashes or external authentication tokens that should not be modifiable via general API endpoints without elevated privileges.
This oversight creates a severe mass assignment vulnerability where an authenticated attacker can manipulate internal security states of other user accounts. By crafting specific HTTP requests containing controlled data for fields like password_hash, salt, or external_auth_only, the attacker bypasses standard authorization checks. The application accepts these inputs because it only confirms field existence rather than evaluating their sensitivity level or visibility constraints. Consequently, an adversary with valid credentials can overwrite another user's authentication hash, effectively taking over that account without knowing its original password. This capability extends to modifying external authentication flags, potentially disabling multi-factor authentication or altering single sign-on configurations for targeted users.
The operational impact of this vulnerability is profound, as it directly compromises the confidentiality and integrity of user accounts within the SuiteCRM instance. An attacker can achieve unauthorized access to any account by resetting its password hash to a value they control. This leads to full account takeover, allowing the adversary to view sensitive customer data, modify business records, or use the compromised account for further lateral movement within the organization's infrastructure. The vulnerability is particularly dangerous because it requires only basic authentication, which is often readily available through legitimate user accounts that may have lower privilege levels but still possess API access rights.
From a classification perspective, this flaw aligns with CWE-284 Improper Access Control and CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes, commonly known as mass assignment. In the context of the MITRE ATT&CK framework, this vulnerability facilitates Account Manipulation techniques under the Initial Access or Persistence tactics, depending on whether the attacker uses it to gain entry or maintain access after initial compromise. The lack of enforcement for sensitive metadata represents a failure in implementing defense-in-depth principles, where multiple layers of security controls should validate data integrity and user permissions at every stage of processing.
Mitigation strategies focus primarily on upgrading the SuiteCRM installation to version 7.15.2 or 8.10.2, which corrects the validation logic by ensuring that sensitive fields are properly restricted during write operations regardless of their existence in the schema. For organizations unable to patch immediately due to operational constraints, temporary mitigations include restricting API access through network-level controls such as firewalls or reverse proxies, limiting exposure only to trusted IP addresses. Additionally, implementing strict input validation at the application gateway level can help filter out requests attempting to modify known sensitive fields like password_hash before they reach the vulnerable code path. Regular security audits and penetration testing should be conducted to identify similar patterns of incomplete access control in other modules or endpoints within the CRM system.