CVE-2026-100362

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The /legacy/Api/V8/OAuth2 password-grant endpoint returns distinct error messages when an invalid username is provided compared to when an invalid password is used. This behavior allows an unauthenticated remote attacker to enumerate valid usernames, which can then be targeted using credential stuffing, password spraying, brute-force, or social-engineering attacks.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.