Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoint checks only view and list permissions before a one-to-many relationship writes a target record's foreign key, without enforcing the required edit permission. A low-privileged user can reassign records, alter ownership and security-relevant relationships, expand cross-user access, and manipulate workflows. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-05T19:17:22.550Z",
  "pubdate": "2026-11-05T19:17:22.550Z",
  "executiveSummary": "This vulnerability is an improper access control flaw within the SuiteCRM API, specifically affecting the management of one-to-many relationship links. The issue resides in the POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoint, which fails to correctly validate user permissions before executing write operations.\nThe vulnerability allows a low-privileged authenticated user to bypass mandatory 'edit' permission checks. By only validating 'view' and 'list' access, the application incorrectly permits unauthorized modifications to record relationships. This leads to severe security implications, including the unauthorized reassignment of records, manipulation of ownership structures, and potential escalation of access across user boundaries.\nAffected products include SuiteCRM versions prior to 7.15.2 and 8.10.2. The risk is significant as it facilitates unauthorized data manipulation and logic corruption, potentially impacting the integrity of security-sensitive workflows within the CRM environment. Exploitation requires valid authentication, but does not require administrative privileges, enabling a low-level user to perform actions typically restricted to privileged roles.",
  "technicalDetails": "The root cause of this vulnerability is an authorization logic error within the API controller responsible for handling relationship modification requests at the /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoint. During the request processing lifecycle, the system performs a security check to verify if the requesting user has the appropriate authorization level to interact with the target record.\nAnalysis of the vulnerable code path reveals that the authorization mechanism only validates 'view' and 'list' permissions. In the context of one-to-many relationships, the modification of a foreign key constitutes a write operation. However, the application fails to verify if the user possesses the required 'edit' permissions on the target module before committing the change to the database.\nThe attack flow proceeds as follows: An authenticated low-privileged user constructs a malicious HTTP POST request targeting the specified endpoint. The user identifies a target module, a specific record ID, and a valid link field name. Because the backend API logic lacks the necessary gatekeeping check for edit permissions, the application proceeds to update the foreign key mapping in the underlying data store.\nThe exploitation allows an attacker to manipulate record relationships without explicit authorization. By reassigning foreign keys, an attacker can effectively modify record ownership, forcing records to be associated with different parent objects. This can be used to bypass security-relevant relationships or grant the attacker unauthorized visibility into records that would otherwise be restricted based on ownership or team-based access controls.\nFurthermore, the ability to manipulate these relationships can be leveraged to disrupt business workflows and trigger unintended side effects within the application logic. Since the CRM relies on these relationships to calculate access rights and trigger automated processes, unauthorized modification can facilitate cross-user data access and system-level configuration changes. The vulnerability is present in all versions of SuiteCRM prior to 7.15.2 and 8.10.2. The lack of granular permission validation at the API controller level ensures that as long as the user is authenticated and has basic access to the object, they can perform unauthorized link modifications."
}