CVE-2026-100360NVD

Vulnerability Summary

Summary SuiteCRM contains write-capable paths that perform protected actions even when the caller lacks the expected edit authorization. In the verified case, a user could create Account-to-Contact relationships through the V8 API despite being unable to edit the Account, and could delete a relationship to a hidden Contact while lacking permission to view that Contact directly.

Severity Level

MEDIUM

Published Date

Oct 12, 2026

Last Modified

Oct 12, 2026

Exploitation Status

No confirmed exploitation yet

CVE Record Status

Reserved

This CVE ID is referenced in a public advisory, but the CVE Program has not published its official CVE Record yet. Full CVSS/CPE data from NVD will appear here once it does.

EPSS Score (30-Day)

Data Pending

Root Weakness (CWE)

CWE-862: Missing Authorization ↗

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected & Patched Versions

Affected Versions

SuiteCRM <= 7.15.1
SuiteCRM <= 8.10.1

Patched Versions

SuiteCRM 7.15.2
SuiteCRM 8.10.2

🎁7-Day Free Trial — Try Pro or Team, no card required.

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

📈EPSS Spike Alerts — Catch rising risk before it peaks.

🎯Custom EPSS/CVSS — Filter noise, focus on risk.

🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.

🐙GitHub Issues — Auto-tracked, no duplicates.

📬Weekly Digest — One clean summary, not inbox spam.

🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).

💬Webhooks — Slack & Teams integration.

🔀Smart Routing — Critical alerts to one channel, rest to another.

🚫Ad-Free — Uninterrupted experience.