CVE-2026-100360: SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records. In the verified Account-to-Contact case, an authenticated user can create a relationship while unable to edit the Account and can delete relationship links to a hidden Contact that cannot be viewed directly. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
SuiteCRM deployments running versions earlier than 7.15.2 or 8.10.2 are affected where authenticated users can access V8 API relationship write paths. The verified case involves Account-to-Contact relationships.
What level of access does an attacker need?
An attacker needs an authenticated SuiteCRM account. They can manipulate relationship links despite lacking edit permission on the Account or direct view permission for the related Contact.
Are default permissions enough to prevent exploitation?
The issue is specifically an object-level authorization bypass in V8 API relationship write paths. Any configuration that relies on Account edit restrictions or Contact view restrictions to prevent relationship changes should be considered insufficient on affected versions.
What should teams do if they cannot patch immediately?
Restrict access to the V8 API relationship write paths for lower-privileged authenticated users where possible. Review and limit accounts that can make API relationship changes until upgrading.
How can administrators determine whether they may already be affected?
Review SuiteCRM version information: versions before 7.15.2 and 8.10.2 are affected. Audit V8 API relationship activity for relationship creation or deletion performed by users who did not have permission to edit the Account or view the related Contact.