Skip to content
OpenAdvisories
High WID-SEC-2026-3887 8 CVEs

SuiteCRM: Mehrere Schwachstellen

Published Oct 12, 2026 · Updated Nov 5, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in SuiteCRM ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.

Product

SuiteCRM ist eine Open-Source-Customer-Relationship-Management-Anwendung (CRM) zur Verwaltung von Kundenbeziehungen.

Vulnerabilities 8

  • Critical 9.4
    CVE-2026-100358

    SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP langu…

    Suite CRM SuiteCRM
  • High 8.8
    CVE-2026-100363

    SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The affected flow …

    Suite CRM SuiteCRM
  • High 8.8
    CVE-2026-97377

    SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query con…

    Suite CRM SuiteCRM
  • High 7.1
    CVE-2026-100360

    SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records.…

    Suite CRM SuiteCRM
  • High 7.1
    CVE-2026-100361

    SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field…

    Suite CRM SuiteCRM
  • High 7.1
    CVE-2026-100364

    SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The af…

    Suite CRM SuiteCRM
  • Medium 6.9
    CVE-2026-100362

    SuiteCRM: V8 OAuth2 Username Enumeration

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the /legacy/Api/V8/OAuth2 password-grant endpoint returns distinct error messages for an invalid username and an invalid pass…

    Suite CRM SuiteCRM
  • Medium 6.5
    CVE-2026-100359

    SuiteCRM: Authenticated SQL Injection In action_get_end_date function

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project Template module's action_get_end_date function interpolates authenticated caller-controlled task_id and lag POST …

    Suite CRM SuiteCRM

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-117728, EUVD-2026-117727, EUVD-2026-117729, EUVD-2026-117722, EUVD-2026-117719, EUVD-2026-117720, EUVD-2026-117718, EUVD-2026-117721

  2. #1

    Initiale Fassung

References