CVE-2026-100364

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord and...

CVE-2026-100364 SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord and...

CVE-2026-100364 SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord and...

CVE-2026-100364

The SuiteCRM CRM software (prior to versions 7.15.2 and 8.10.2 ) is vulnerable to an authorization bypass due to a flaw in the V8 JSON:API update path. Specifically, the updateRecord() flow fails to remove the id attribute before assigning user-supplied attributes to a SugarBean . This allows an ...

PT-2026-36650

Summary A prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the applyUpdate and updateRecord functions which use Object.assign to merg...

Cross site scripting

Cross-site scripting XSS vulnerability in FlatnuX CMS aka Flatnuke3 2008-12-11 allows remote attackers to inject arbitrary web script or HTML via the name parameter in an updaterecord action to index.php in the 08Files module. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-5759: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in FlatnuX CMS aka Flatnuke3 2008-12-11 allows remote attackers to inject arbitrary web script or HTML via the name parameter in an updaterecord action to index.php in the 08Files module. NOTE: the provenance of this information is unknown; the details are...