SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The affected flow begins at /Api/V8/module and uses ACLRoles, ACLActions, and Administration to carry attacker-controlled data or authorization state into the security-sensitive operation. A low-privileged user can create roles, change ACL levels, bind elevated roles, and alter global configuration to obtain administrator-equivalent control of CRM data and behavior. This issue is fixed in versions 7.15.2 and 8.10.2.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…iteCRM/security/advisories/GHSA-rxx9-4rg7-c3qp Diğer
• github.com/…ommit/a11f50180d939f639cc468b5d536e8ad714dfb68 Diğer
• github.com/…ommit/d6bca97a0159ec019a969b86eca32affab3beb7c Diğer
• github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2 Diğer
• github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2 Diğer

Kayıt geçmişi

1. 5 Kas 2026 21:47Yayımlandı

İlgili açıklar

• 9,4 CVE-2026-100358SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection
• 6,5 CVE-2026-100359SuiteCRM: Authenticated SQL Injection In action_get_end_date function
• 6,9 CVE-2026-100362SuiteCRM: V8 OAuth2 Username Enumeration
• 8,8 CVE-2026-97377SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
• 7,1 CVE-2026-100360SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record
• 7,1 CVE-2026-100361SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)