CVE-2026-100363

Summary

A low-privileged authenticated user can abuse the V8 API's exposed CRUD operations on administrator-only modules (ACLRoles, ACLActions, Administration) to escalate privileges and gain full administrative control of SuiteCRM.

Exploitability

Exploitation requires only a valid OAuth2 login as any non-admin user; no special tools or network access beyond the API endpoint.

Blast radius

An attacker can fully compromise confidentiality, integrity, and availability of all CRM data and configurations by creating elevated roles, modifying ACLs, and altering global settings.

Detection

Monitor for API calls to /Api/V8/module targeting ACLRoles, ACLActions, or Administration resources by non-admin users, especially those performing POST/PUT operations that modify role assignments or global configuration entries.

Prioritized remediation

Upgrade to SuiteCRM version 7.15.2 or 8.10.2 immediately; until then, disable or restrict access to the /Api/V8/module endpoint for non-administrative users.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.