Observable Response Discrepancy in SuiteCRM - CVE-2026-100362
Published: November 9, 2026
Vulnerability identifier: #VU162636
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100362
CWE-ID: CWE-204
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to enumerate valid SuiteCRM usernames on instances exposing the OAuth2 endpoint.
The vulnerability exists due to distinct authentication error messages for invalid usernames and invalid passwords when processing password-grant requests at the V8 OAuth2 endpoint. An unauthenticated remote attacker can submit candidate usernames to /legacy/Api/V8/OAuth2 and compare errors to identify existing CRM accounts without victim interaction.
Affected software
SuiteCRM
How to mitigate CVE-2026-100362
Install security update from vendor's website.
SuiteCRM - addressed in versions 7.15.2, 8.10.2