CVE-2026-100363: SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The affected flow begins at /Api/V8/module and uses ACLRoles, ACLActions, and Administration to carry attacker-controlled data or authorization state into the security-sensitive operation. A low-privileged user can create roles, change ACL levels, bind elevated roles, and alter global configuration to obtain administrator-equivalent control of CRM data and behavior. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OAuth2 user, including a low-privileged account, can exploit the affected V8 module API. No administrator privileges or user interaction are required.
Which deployments are affected?
SuiteCRM versions earlier than 7.15.2 and earlier than 8.10.2 are affected. The vulnerable flow uses the /Api/V8/module endpoint and the ACLRoles, ACLActions, and Administration modules.
What could an attacker do after exploitation?
An attacker can create roles, modify ACL levels, assign elevated roles, and change global configuration. This can provide administrator-equivalent control over CRM data and behavior.
What should be done to remediate the issue?
Upgrade SuiteCRM to version 7.15.2 or 8.10.2, depending on the deployed release line. The issue is fixed in those versions.