Summary The SuiteCRM V8 REST API (`/Api/V8/module/...`) lets any authenticated user perform full CRUD on modules that are supposed to be administrator-only (`ACLRoles`, `ACLActions`, and `Administration`). A low-privileged user with a valid OAuth2 token can read and modify the security model (create roles, change ACL access levels) and write global `Administration` config rows. This is a broken access-control flaw that enables privilege escalation toward administrator-equivalent control. Impact This is a missing-authorization vulnerability (CWE-862 Missing Authorization; CWE-269 Improper Privilege Management). Suggested severity High, CVSS:3.1 `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` (8.8). Any authenticated, non-administrator user can: - Read and write the access-control model (enumerate/create `ACLRoles` and modify `ACLActions` access levels). Combined with the V8 relationship endpoints (used to bind a role to the attacker's user), this lets a normal user grant themselves administrator-equivalent ACL on every module, i.e. read/write of all records across the instance. - Tamper with global configuration (write arbitrary `Administration`/`config` rows, e.g. security/auth-related settings consumed by other admin features). Because the password grant authenticates the end user (the token carries that user's identity, with no per-module scoping), any deployment that has enabled the V8 API turns every user account into a viable starting point. An administrator who provisions API access for ordinary users (e.g. via a client app or integration) does not intend to also grant them the ability to rewrite the security model. The result is privilege escalation from a low-privileged account to administrator-equivalent control of the CRM and its data.