CVE-2026-63111

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The V8 module API lacks module-level authorization, allowing a low-privileged user to create SchedulersJobs records with attacker-controlled target values. The affected flow starts at the '/Api/V8/module' endpoint and utilizes SchedulersJobs, target, cron.php, and url:: to inject data or authorization states into security-sensitive operations. Subsequently, cron.php executes the queued job with system privileges, while the url:: target enables server-side requests to internal or external hosts, follows redirects, persists as recurring jobs, and potentially exposes internal services.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.