CVE-2026-100364

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow starts at the updateRecord() function and utilizes processAttributes(), id, and ACL ALLOW OWNER to pass attacker-controlled data or authorization states into a security-sensitive operation. This allows an authenticated user to substitute a victim record identifier, bypass owner-only authorization, overwrite other records, and hijack record ownership.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.