CVE-2026-100364
Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in SuiteCRM via JSON:API

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord() and uses processAttributes(), id, and ACL_ALLOW_OWNER to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can substitute a victim record identifier, bypass owner-only authorization, overwrite another record, and hijack record ownership. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-100364
EUVD
EUVD-2026-117718

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100364 is an authorization bypass vulnerability in SuiteCRM affecting versions before 7.15.2 and 8.10.2. The issue occurs in the V8 JSON:API's updateRecord() function where processAttributes() fails to remove the id attribute from user input. This allows authenticated attackers to manipulate record ownership by injecting a victim's ID, bypassing ACL restrictions like ACL_ALLOW_OWNER. The attacker can then overwrite any CRM record and hijack its ownership.

Detection Guidance

To detect this vulnerability, check SuiteCRM versions for 7.15.1 or earlier and 8.10.1 or earlier. Inspect API logs for suspicious updateRecord() calls with modified IDs or ACL_ALLOW_OWNER bypass attempts.

Impact Analysis

An attacker could exploit this to modify or delete sensitive CRM data, including customer records, financial information, or proprietary details. They could also take ownership of records, potentially gaining unauthorized access to restricted information. The attack requires only low-level user privileges and no user interaction, making it relatively easy to execute remotely.

Compliance Impact

This vulnerability could lead to unauthorized data modification or deletion, violating integrity requirements in GDPR and HIPAA. GDPR mandates strict data accuracy and protection, while HIPAA requires safeguards for protected health information. Exploitation could result in non-compliance, potential fines, and loss of trust due to compromised data integrity and unauthorized access.

Mitigation Strategies

Upgrade SuiteCRM to versions 7.15.2 or 8.10.2 immediately. Review and restrict API access, audit user permissions, and monitor for unauthorized record modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100364. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...