GHSA-8rjm-vpj3-hch8: SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord() and uses processAttributes(), id, and ACLALLOWOWNER to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can substitute a victim record identifier, bypass owner-only authorization, overwrite another record, and hijack record ownership. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRM 7.xto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRM 8.xto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Which deployments are affected?
SuiteCRM versions earlier than 7.15.2 and 8.10.2 are affected when the V8 JSON:API update path is available. The issue is fixed in versions 7.15.2 and 8.10.2.
What access does an attacker need?
An attacker must be authenticated and have low-level privileges. No user interaction is required, and the attack can be performed over the network.
What can an attacker do?
The attacker can supply a victim record identifier during an update operation, bypass owner-only authorization, overwrite another record, and take ownership of that record.
What is the practical mitigation?
Upgrade SuiteCRM to version 7.15.2 or 8.10.2. The provided information does not identify a configuration workaround for systems that cannot be upgraded immediately.