Improperly Controlled Modification of Dynamically-Determined Object Attributes in SuiteCRM - CVE-2026-100361
Published: October 13, 2026
Vulnerability identifier: #VU154187
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100361
CWE-ID: CWE-915
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify sensitive user authentication fields.
The vulnerability exists due to mass assignment in the SuiteCRM V8 REST API write path when processing module update requests without enforcing field visibility and sensitivity restrictions. A remote user can send PATCH requests to /Api/V8/module containing user_hash or external_auth_only attributes to modify sensitive user authentication fields.
The API read path suppresses these fields from responses.
Affected software
SuiteCRM
How to mitigate CVE-2026-100361
Install security update from vendor's website.
SuiteCRM - addressed in versions 7.15.2, 8.10.2