EXECUTIVE SUMMARY:
Multiple security vulnerabilities affecting SuiteCRM versions * SuiteCRM 8 have been identified in SuiteCRM, including a critical remote code execution flaw. Affected versions include SuiteCRM 8.10.1 and earlier, as well as SuiteCRM 7.15.1 and earlier. The overall risk/impact is significant, as a breach can expose an entire business relationship history.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple security vulnerabilities affecting SuiteCRM versions * SuiteCRM 8 have been identified in SuiteCRM, including a critical remote code execution flaw. Affected versions include SuiteCRM 8.10.1 and earlier, as well as SuiteCRM 7.15.1 and earlier. The overall risk/impact is significant, as a breach can expose an entire business relationship history.[emaillocker id="1283"]
CVE-2026-100358 (CVSS 9.4 — Critical): It is a vulnerability involving code injection in the Studio Dropdown Editor that allows an administrator to inject PHP code, which the application saves to a file loaded on every page, resulting in persistent OS-level code execution as www-data.
CVE-2026-100363 (CVSS 8.8 — High): It is a vulnerability in the V8 API that enables user-to-admin privilege escalation from a low-privileged account to administrator-equivalent control of the CRM and its data by allowing the editing of admin-only modules, including role and permission settings.
CVE-2026-97377 (CVSS 8.8 — High): It is a vulnerability caused by SQL injection in the SOAP portal that opens the door to database theft, potentially leading to remote code execution under certain database configurations.
CVE-2026-100364 (CVSS 7.1 — High): It is a vulnerability affecting the SuiteCRM V8 JSON:API updateRecord() endpoint that allows authenticated users to overwrite other users' CRM records by manipulating the id attribute and bypassing ownership-based access controls.
CVE-2026-100361 (CVSS 7.1 — High): It is a vulnerability affecting the SuiteCRM V8 REST API that allows authenticated users to modify sensitive, hidden authentication fields such as user_hash and external_auth_only, potentially compromising account security in environments using LDAP, SAML, Active Directory, or other external authentication providers.
CVE-2026-100362 (CVSS 6.9 — Medium): It is a username enumeration vulnerability affecting the SuiteCRM V8 OAuth2 password-grant endpoint that allows unauthenticated attackers to identify valid CRM accounts through differing error messages, potentially enabling password spraying, credential stuffing, social engineering, and brute-force attacks.
CVE-2026-100359 (CVSS 6.5 — Medium): It is a vulnerability affecting the SuiteCRM Project Template module that allows authenticated users to exploit SQL injection through unsanitized input, potentially exposing sensitive CRM data, user credentials, and administrator password hashes, leading to complete application compromise.
CVE-2026-100360 (CVSS 6.5 — Medium): It is a vulnerability affecting the SuiteCRM V8 API that allows unauthorized users to create or delete CRM relationships without the required edit permissions, potentially enabling unauthorized data modifications and access-control bypasses.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://securityonline.info/suitecrm-vulnerabilities-rce/