CVE-2026-100360High· 7.1▾ TwilightSuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records. In the verified Account-to-Contact case, an authenticated user can create a relationship while unable to edit the Account and can delete relationship links to a hidden Contact that cannot be viewed directly. This issue is fixed in versions 7.15.2 and 8.10.2.
SuiteCRM < 7.15.2SuiteCRM >= 8.0.0, < 8.10.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61650High· 8.1SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization
CVE-2026-63111High· 7.1SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron
CVE-2026-97377High· 8.8SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
CVE-2026-63218Medium· 6.5SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage
CVE-2026-69141High· 8.3SuiteCRM: SQL injection via search param in modules/Cases/controller.php
CVE-2026-63213High· 7.2SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM