Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The affected flow begins at /Api/V8/module and uses ACLRoles, ACLActions, and Administration to carry attacker-controlled data or authorization state into the security-sensitive operation. A low-privileged user can create roles, change ACL levels, bind elevated roles, and alter global configuration to obtain administrator-equivalent control of CRM data and behavior. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-05T19:16:58.207Z",
  "pubdate": "2026-11-05T19:16:58.207Z",
  "executiveSummary": "SuiteCRM versions prior to 7.15.2 and 8.10.2 contain a critical Broken Access Control vulnerability within the V8 module API.\nThe flaw permits authenticated OAuth2 users, regardless of their original privilege level, to perform unauthorized CRUD (Create, Read, Update, Delete) operations on administrative modules.\nBy manipulating ACLRoles, ACLActions, and system configurations, an attacker can elevate their own privileges to that of an administrator.\nThis vulnerability grants unauthorized actors complete control over sensitive CRM data and system behaviors, posing a significant risk to organizational confidentiality, integrity, and availability.\nThe exploit requires valid authentication via the OAuth2 mechanism, but does not necessitate existing administrative credentials.\nThe core issue stems from the API's failure to enforce strict server-side authorization checks for modules restricted to administrators.",
  "technicalDetails": "The vulnerability resides within the V8 API architecture of SuiteCRM, specifically affecting the endpoint '/Api/V8/module'.\nThe root cause is a failure in the API's authorization logic, which incorrectly permits authenticated OAuth2 users to access and modify modules and settings that should be reserved for administrative users.\nThe attack flow initiates through the V8 module API, where the application fails to validate the user's role against the required ACL (Access Control List) permissions before executing CRUD operations.\nBy interacting with 'ACLRoles', 'ACLActions', and 'Administration' components, an attacker can inject controlled data to modify the system's security state.\nAn authenticated, low-privileged user can systematically create new roles, adjust ACL privilege levels, and bind these elevated roles to their own user account.\nFurthermore, the attacker can leverage the lack of restricted access to the 'Administration' module to alter global configuration settings, effectively bypassing intended security constraints.\nBecause the API processes these requests without verifying whether the initiating user possesses the requisite administrative authorization, the system honors the malicious configuration changes.\nThe impact of this exploit is a full privilege escalation. Once an attacker has modified the ACLs or configuration, they gain administrator-equivalent permissions, allowing them to access, exfiltrate, or delete any data within the CRM, execute arbitrary workflows, or modify system logs to obfuscate their activities.\nAffected versions are identified as any version prior to 7.15.2 and 8.10.2. The exposure is limited to authenticated users, meaning the network exposure is contingent upon the accessibility of the OAuth2 authentication portal.\nThere are no complex payload requirements; standard API requests formatted to interact with the aforementioned module controllers are sufficient to trigger the unauthorized state changes."
}