CVE-2026-100362: SuiteCRM: V8 OAuth2 Username Enumeration
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the /legacy/Api/V8/OAuth2 password-grant endpoint returns distinct error messages for an invalid username and an invalid password. An unauthenticated remote attacker can use those response differences to enumerate valid CRM usernames and target confirmed accounts with password spraying, credential stuffing, brute-force, or social-engineering attacks. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Which deployments are exposed?
SuiteCRM deployments running versions earlier than 7.15.2 or 8.10.2 are affected if the /legacy/Api/V8/OAuth2 password-grant endpoint is reachable by an attacker.
Does exploitation require an account or user interaction?
No. An unauthenticated remote attacker can compare error responses from the password-grant endpoint to determine whether submitted usernames are valid.
What can an attacker do with the disclosed information?
The issue exposes valid CRM usernames rather than directly granting account access. Confirmed usernames can be used to make password spraying, credential stuffing, brute-force, or social-engineering attacks more targeted.
How can I remediate the issue?
Upgrade SuiteCRM to version 7.15.2 or 8.10.2, which correct the distinct error responses for invalid usernames and invalid passwords.