CVE-2026-61650: SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoint checks only view and list permissions before a one-to-many relationship writes a target record's foreign key, without enforcing the required edit permission. A low-privileged user can reassign records, alter ownership and security-relevant relationships, expand cross-user access, and manipulate workflows. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Which deployments are affected?
SuiteCRM versions before 7.15.2 and before 8.10.2 are affected. Deployments running either fixed version are not affected by this issue.
What access does an attacker need to exploit this?
An attacker needs an authenticated low-privileged SuiteCRM account with view and list permissions for the relevant records or relationship. They do not need edit permission, user interaction, or a complex attack path.
What can a successful attacker do?
They can create one-to-many relationships that write a target record's foreign key despite lacking edit authorization. This can reassign records, change ownership or security-relevant relationships, expand access across users, and manipulate workflows.
How can I determine whether my environment is exposed?
Check whether the SuiteCRM instance is running a version earlier than 7.15.2 or 8.10.2 and whether low-privileged users can access the V8 relationship-creation endpoint. Review relationship changes, foreign-key updates, ownership changes, and workflow activity initiated by accounts that lacked edit permission for the affected records.