CVE-2026-61650

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The application fails to enforce edit permissions when using the 'POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName}' endpoint. The system only verifies view and list permissions before a one-to-many relationship writes a target record's foreign key. This allows a low-privileged user to reassign records, alter ownership and security-relevant relationships, expand cross-user access, and manipulate workflows.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.