Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-100364

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord() and uses processAttributes(), id, and ACL_ALLOW_OWNER to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can substitute a victim record identifier, bypass owner-only authorization, overwrite another record, and hijack record ownership. This issue is fixed in versions 7.15.2 and 8.10.2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 15.7%
CVSS Severity
CVSS v3 Score 7.1
Products affected by CVE-2026-100364


Contact Us

Shodan ® - All rights reserved