CVE-2026-100363 SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The affected flow begins at /Api/V8/module and uses...

CVE-2026-100363

Prior to versions 7.15.2 and 8.10.2 , SuiteCRM is vulnerable to privilege escalation because the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The vulnerability exists in the flow starting at /Api/V8/module , where attacker-controlled data ...