Summary The SuiteCRM V8 REST API allows authenticated users to modify fields marked as `api-visible: false` and `sensitive: true` in vardef definitions. While the read path correctly suppresses these fields from API responses, the write path only validates field existence and does not enforce the same restrictions. As a result, authenticated users can modify sensitive fields including: `user_hash` `external_auth_only` through `PATCH /Api/V8/module`. This creates a read/write authorization mismatch where fields intentionally hidden from API consumers remain writable through the API. --- Impact An authenticated user can modify sensitive fields that are explicitly marked as hidden from API consumers. Observed impacts include: Direct modification of `user_hash` through the V8 API. Direct modification of authentication-related fields (user_hash, external_auth_only) that are intentionally hidden from API consumers through api-visible:false and/or sensitive:true metadata. Modification of `external_auth_only`. Potential impact on deployments using LDAP, SAML, Active Directory, or other external authentication providers if authentication-related flags can be modified by authenticated users. This issue may allow users to persist access by directly modifying internal authentication attributes rather than using intended account-management workflows.