CVE-2026-100360

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The V8 API relationship write paths fail to consistently enforce object-level edit and view authorization for related records. This allows an authenticated user to create a relationship even if they lack permission to edit the Account, or delete relationship links to a Contact that is hidden and cannot be viewed directly.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.