Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord() and uses processAttributes(), id, and ACL_ALLOW_OWNER to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can substitute a victim record identifier, bypass owner-only authorization, overwrite another record, and hijack record ownership. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-05T19:16:58.647Z",
  "pubdate": "2026-11-05T19:16:58.647Z",
  "executiveSummary": "This vulnerability is an Insecure Direct Object Reference (IDOR) and authorization bypass flaw within the V8 JSON:API implementation of SuiteCRM.\nThe issue stems from the failure to sanitize the 'id' attribute during record updates, allowing authenticated users to manipulate object ownership and overwrite data belonging to other users.\nAffected products include SuiteCRM versions prior to 7.15.2 and 8.10.2.\nAn authenticated attacker can leverage this flaw to substitute victim record identifiers, bypass 'ACL_ALLOW_OWNER' constraints, and perform unauthorized modifications to sensitive data records.\nThe risk is high, as it enables unauthorized data modification and privilege escalation by hijacking record ownership, directly compromising the integrity and confidentiality of the CRM system.\nSuccessful exploitation requires an active authenticated session, though the attacker does not require administrative privileges to target other user records.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper processing of user-supplied attributes within the SuiteCRM V8 JSON:API update path. Specifically, the 'updateRecord()' function facilitates the assignment of attributes to a 'SugarBean' object without explicitly stripping or validating the 'id' attribute before the data mapping occurs.\nIn the affected versions, the 'processAttributes()' function processes incoming JSON data. Due to the lack of sanitization, the application treats the 'id' field provided in the payload as a trusted identifier for the target object rather than restricting it to a system-controlled parameter. This allows an attacker to inject an arbitrary record identifier into the 'SugarBean' instantiation process.\nThe exploitation flow begins when an authenticated user sends a crafted JSON:API request targeting the update endpoint. By manipulating the 'id' attribute within the request body, the attacker forces the application to load a 'SugarBean' instance associated with a victim's record. Because the application logic fails to re-validate ownership or properly sanitize the 'id' input, it proceeds to apply the attacker-supplied attributes to the victim's record.\nThe vulnerability effectively subverts the 'ACL_ALLOW_OWNER' security control. Normally, this mechanism ensures that users can only modify records they own or have permissions to access. However, because the attacker can influence the object selection via the unsanitized 'id' field, the ACL check is performed against a manipulated context or bypassed entirely if the underlying bean assignment logic assumes the identifier is legitimate. Consequently, the application updates the target record with the provided payload.\nThe impact is significant: an attacker can successfully overwrite critical business data, modify record ownership, and hijack records that were previously restricted. This allows for horizontal privilege escalation, as attackers can alter records across the CRM database that should be isolated. Since the payload is processed as part of a legitimate update operation, it can be difficult to detect via standard integrity monitoring until after the data modification has occurred. The vulnerability is present in all SuiteCRM deployments utilizing the V8 JSON:API prior to the specified patched versions."
}