Insecure Relationship Reassignment in SuiteCRM

Executive Summary

SuiteCRM versions before 7.15.2 and 8.10.2 have an incorrect access control flaw in the V8 API. The POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoint only checks view and list permissions before writing a foreign key in one-to-many relationships. This allows low-privileged users to bypass authorization checks and modify relationships without edit permissions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check SuiteCRM versions for 7.15.1 or below and 8.10.1 or below. Inspect API logs for unauthorized POST requests to /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoints. Look for low-privileged users modifying foreign keys or record ownership.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could reassign records, change ownership, expand cross-user access, manipulate workflows, and alter business logic across modules. This could lead to unauthorized data exposure, integrity issues, or workflow disruptions in the CRM system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access or modification of sensitive data, potentially leading to data breaches. GDPR and HIPAA require strict access controls and data integrity, which this flaw undermines.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SuiteCRM to versions 7.15.2 or 8.10.2 or later. Review and restrict API access for low-privileged users. Monitor API endpoints for suspicious relationship modification attempts. Apply principle of least privilege to all user roles.

Useful 0 Not Useful 0