Missing Authorization in SuiteCRM - CVE-2026-100360
Published: October 13, 2026
Vulnerability identifier: #VU154186
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100360
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify protected record relationships without the required authorization.
The vulnerability exists due to missing object-level authorization in V8 API relationship operations when handling relationship creation and deletion requests. A remote user can create Account-to-Contact relationships without permission to edit the Account or delete relationships to Contacts they cannot view to modify protected record relationships without the required authorization.
Affected software
SuiteCRM
How to mitigate CVE-2026-100360
Install security update from vendor's website.
SuiteCRM - addressed in versions 7.15.2, 8.10.2