CVE-2026-100361

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description An authenticated user can perform mass assignment of internal authentication fields because the V8 write path verifies field existence but fails to enforce metadata that hides sensitive or non-API-visible fields during read operations. This allows an attacker to modify password hashes or external authentication flags to maintain unauthorized account access. The issue occurs at the 'PATCH /Api/V8/module' endpoint using the user hash and external auth only variables.

Recommendations Update to version 7.15.2. Update to version 8.10.2.