CVE-2026-100363

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The V8 module API exposes CRUD (Create, Read, Update, Delete) operations for administrator-only modules to any authenticated OAuth2 user. The affected flow starts at the '/Api/V8/module' endpoint and utilizes ACLRoles, ACLActions, and Administration to inject attacker-controlled data or authorization states into security-sensitive operations. This allows a low-privileged user to create roles, modify ACL levels, bind elevated roles, and change global configurations to gain administrator-equivalent control over CRM data and behavior.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.