CVE-2026-100362 in SuiteCRM
Summary
by MITRE • 11/05/2026
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the /legacy/Api/V8/OAuth2 password-grant endpoint returns distinct error messages for an invalid username and an invalid password. An unauthenticated remote attacker can use those response differences to enumerate valid CRM usernames and target confirmed accounts with password spraying, credential stuffing, brute-force, or social-engineering attacks. This issue is fixed in versions 7.15.2 and 8.10.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
SuiteCRM serves as a widely deployed open-source Customer Relationship Management platform used by enterprises to manage customer interactions and data. A significant information disclosure vulnerability exists within the legacy OAuth2 authentication endpoint, specifically at the /legacy/Api/V8/OAuth2 password-grant path in versions prior to 7.15.2 and 8.10.2. This flaw stems from inconsistent error handling mechanisms that fail to provide uniform responses for different types of authentication failures. When an attacker submits credentials with a valid username but an incorrect password, the system returns one specific error message. Conversely, when the submitted username does not exist in the database, the system returns a distinctly different error response. This behavioral discrepancy creates a reliable side-channel that allows external actors to determine whether a given username is registered within the application without needing prior knowledge of valid credentials.
The operational impact of this vulnerability centers on user enumeration and subsequent credential-based attacks. By systematically testing usernames against the API endpoint, an unauthenticated remote attacker can build a list of active accounts with high accuracy. This capability significantly lowers the barrier for initiating password spraying campaigns, where attackers try common passwords across many known accounts, or credential stuffing attacks using leaked credentials from other breaches. Once valid users are identified, they become prime targets for brute-force attempts or social engineering tactics aimed at resetting their passwords. The ability to distinguish between invalid usernames and incorrect passwords effectively neutralizes the primary defense against automated account enumeration tools, thereby facilitating unauthorized access if weak password policies are in place.
From a classification perspective, this vulnerability aligns with CWE-204: Observable Response Discrepancy, which describes situations where an application provides different outputs for similar conditions that should be treated identically to prevent information leakage. It also relates closely to CWE-287: Improper Authentication, as the flaw undermines the integrity of the authentication process by leaking user existence data. In terms of adversary tactics, this behavior supports ATT&CK technique T1087: Account Discovery and facilitates T1110: Brute Force or T1110.003: Password Spraying. The vulnerability allows attackers to efficiently filter out non-existent accounts before expending resources on password guessing attempts for those specific identifiers, thereby increasing the efficiency of automated attack campaigns against SuiteCRM deployments.
Mitigation requires immediate action by administrators running affected versions. The primary remediation is to upgrade SuiteCRM to version 7.15.2 or later, which includes patches that standardize error responses regardless of whether the username is valid or invalid. Until an upgrade can be performed, organizations should implement network-level controls such as rate limiting on authentication endpoints to slow down enumeration attempts and detect anomalous traffic patterns indicative of brute-force activity. Additionally, enforcing strict password complexity requirements and multi-factor authentication for all user accounts can mitigate the risk posed by successful credential stuffing or spraying attacks that may follow username discovery. Monitoring logs for repeated failed login attempts from single sources is also recommended as a defensive measure to identify ongoing exploitation efforts.