Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at PATCH /Api/V8/module and uses user_hash, external_auth_only, api-visible: false, and sensitive: true to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can mass-assign internal authentication fields, modify password hashes or external-authentication flags, and persist unauthorized account access. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-05T19:16:57.780Z",
  "pubdate": "2026-11-05T19:16:57.780Z",
  "executiveSummary": "SuiteCRM is susceptible to an improper authorization vulnerability within its V8 API, specifically concerning the handling of internal field metadata during PATCH requests.\nThe vulnerability occurs because the V8 write path fails to enforce api-visible and sensitive metadata constraints that typically restrict the read and write access of specific system fields.\nThis flaw enables authenticated attackers to perform mass-assignment attacks on critical user authentication fields, including password hashes and external authentication flags.\nBy bypassing intended security restrictions, an attacker can manipulate internal security states, leading to unauthorized account access, privilege escalation, or the persistent compromise of user accounts.\nThe issue affects versions of SuiteCRM prior to 7.15.2 and 8.10.2. Successful exploitation requires an authenticated session, but it provides the attacker with high-impact capabilities to modify security-sensitive data that should be shielded from API-based modification.\nThe risk is critical, as it undermines the fundamental integrity of the application's authentication and authorization mechanisms.",
  "technicalDetails": "The root cause of this vulnerability lies in an inconsistent enforcement of field metadata constraints within the SuiteCRM V8 API architecture. During a PATCH request targeting /Api/V8/module, the application performs a validation check to verify the existence of a requested field; however, this validation logic is decoupled from the security metadata that dictates field sensitivity and API visibility.\nSpecifically, the system fails to verify if fields marked with 'api-visible: false' or 'sensitive: true' are eligible for modification via the API write path. These metadata flags are intended to protect critical system fields from being accessed or modified through external API calls.\nAn authenticated user can exploit this logic flaw by crafting a PATCH request to /Api/V8/module that includes restricted fields such as 'user_hash', 'external_auth_only', or other security-sensitive attributes. Because the write path validation is limited to existence checks, the API accepts the payload and overwrites these internal fields in the underlying database.\nThe attack flow proceeds as follows: First, the attacker establishes an authenticated session with the SuiteCRM instance. Second, the attacker identifies target user records. Third, the attacker initiates a PATCH /Api/V8/module request, injecting controlled data into the prohibited authentication fields. Because the application ignores the 'sensitive: true' metadata during the write operation, the backend logic proceeds to update the user account record directly.\nThe impact of this mass-assignment is significant. By modifying the 'user_hash', an attacker can effectively reset or force the password hash for any user, including administrative accounts. Similarly, manipulating 'external_auth_only' allows an attacker to bypass standard password authentication workflows by toggling external authentication requirements, facilitating persistent unauthorized access.\nThis vulnerability is present in all versions of SuiteCRM prior to 7.15.2 and 8.10.2. The lack of proper server-side filtering on the V8 API write path creates a direct vector for privilege escalation and account takeover, as the API inherently trusts the client-provided input for fields that should be immutable or restricted to system-level operations only."
}