Missing Authorization in SuiteCRM - CVE-2026-61650
Published: August 1, 2026
Vulnerability identifier: #VU140686
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-61650
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
SuiteCRM
SuiteCRM
Detailed vulnerability description
The vulnerability allows a remote user to modify security-relevant relationships and ownership fields on records they should not be able to edit.
The vulnerability exists due to missing authorization in the V8 relationship creation endpoint when handling POST requests to create one-to-many relationships. A remote user can send a specially crafted relationship creation request to modify security-relevant relationships and ownership fields on records they should not be able to edit.
For one-to-many relationships, creating the relationship writes the right-hand-side foreign key into the target record, turning a read-only relationship action into an unauthorized record modification.
How to mitigate CVE-2026-61650
Install security update from vendor's website.