SuiteCRM up to 7.15.1/8.10.1 V8 JSON:API update path updateRecord id improper authorization

Summaryinfo

A vulnerability, which was classified as critical, has been found in SuiteCRM up to 7.15.1/8.10.1. This vulnerability affects the function updateRecord of the component V8 JSON:API update path. The manipulation of the argument ID leads to improper authorization. This vulnerability is documented as CVE-2026-100364. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in SuiteCRM up to 7.15.1/8.10.1. It has been rated as critical. This issue affects the function updateRecord of the component V8 JSON:API update path. The manipulation of the argument id with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord() and uses processAttributes(), id, and ACL_ALLOW_OWNER to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can substitute a victim record identifier, bypass owner-only authorization, overwrite another record, and hijack record ownership. This issue is fixed in versions 7.15.2 and 8.10.2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-100364 since 09/25/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 7.15.2 or 8.10.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• SuiteCRM

Version

• 7.15.0
• 7.15.1
• 8.10.0
• 8.10.1

License

• open-source

Website

• Product: https://github.com/SuiteCRM/SuiteCRM/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion