CVE-2026-100360 SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records. In the verified Account-to-Contact case...