SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)

Overview

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The affected flow begins at /Api/V8/module and uses ACLRoles, ACLActions, and Administration to carry attacker-controlled data or authorization state into the security-sensitive operation. A low-privileged user can create roles, change ACL levels, bind elevated roles, and alter global configuration to obtain administrator-equivalent control of CRM data and behavior. This issue is fixed in versions 7.15.2 and 8.10.2.

Affected

• SuiteCRM < 7.15.2
• SuiteCRM >= 8.0.0, < 8.10.2

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.