CVE-2026-61650 in SuiteCRM
Summary
by MITRE • 11/05/2026
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoint checks only view and list permissions before a one-to-many relationship writes a target record's foreign key, without enforcing the required edit permission. A low-privileged user can reassign records, alter ownership and security-relevant relationships, expand cross-user access, and manipulate workflows. This issue is fixed in versions 7.15.2 and 8.10.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
SuiteCRM serves as a widely deployed open-source Customer Relationship Management platform designed to manage customer interactions, sales pipelines, and marketing campaigns for enterprises of varying sizes. The software relies on granular role-based access control mechanisms to ensure that users can only perform actions appropriate to their assigned privileges within the organizational hierarchy. A critical security flaw was identified in versions prior to 7.15.2 and 8.10.2 regarding how the application handles relationship assignments between records, specifically through the REST API endpoint POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName}. This vulnerability stems from an insufficient authorization check during the process of linking or reassigning related entities within a one-to-many relationship structure.
The technical root cause lies in the permission validation logic executed when writing a target record's foreign key to establish a relationship with another entity. The application incorrectly verifies only view and list permissions before allowing this write operation, completely omitting the necessary check for edit permissions on either the source or target records involved in the linkage. This oversight creates a significant authorization bypass scenario where an authenticated user possessing minimal privileges can manipulate data relationships that should be restricted to higher-privileged roles such as administrators or record owners. By exploiting this flaw, attackers do not need elevated credentials; they only require basic access rights sufficient for viewing and listing modules within SuiteCRM.
The operational impact of this vulnerability is substantial due to the central role CRM systems play in business operations. A low-privileged user can reassign records from one owner to another, effectively altering ownership without authorization. This capability allows attackers to expand cross-user access by linking sensitive data to accounts or contacts they control, thereby gaining indirect visibility into information that should remain confidential. Furthermore, because SuiteCRM workflows often trigger actions based on record relationships and field changes, manipulating these links can lead to unintended workflow executions. An attacker could potentially trigger automated processes designed for specific roles, leading to further privilege escalation or disruption of business logic. This manipulation also compromises data integrity by allowing unauthorized modifications to the structural connections between records, which are critical for accurate reporting and analytics.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it involves an actor obtaining privileges they should not have due to flawed access control checks. It also maps closely to ATT&CK technique T1078 Valid Accounts, where the attacker leverages legitimate credentials but abuses their permissions through logic flaws rather than credential theft or exploitation of software bugs in authentication mechanisms. The ability to reassign records and alter ownership falls under data manipulation tactics that can facilitate lateral movement within an organization's digital environment by gaining trust or access via compromised relationships between entities.
Mitigation strategies must prioritize immediate patching for all affected instances. Organizations running SuiteCRM versions earlier than 7.15.2 or 8.10.2 should upgrade to these fixed releases as soon as possible, ensuring that the vendor's corrected authorization logic is applied. For environments where upgrading is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to restrict access to the specific API endpoint mentioned in the vulnerability description, limiting exposure until a patch is deployed. Additionally, administrators should review existing user roles and permissions to ensure that even with this flaw present, users do not possess excessive view or list privileges on highly sensitive modules, thereby reducing the potential attack surface. Regular audits of workflow configurations and relationship mappings can also help detect any unauthorized changes resulting from exploitation attempts prior to remediation.