SUITECRM has disclosed eight security advisories for flaws in versions 7 and 8, including a high‑risk remote code execution (RCE) bug. The fixes cover SuiteCRM 8.10.1 and earlier, and 7.15.1 and earlier.
Upgrading to SuiteCRM 8.10.2 or 7.15.2 is advised, with the additional step of disabling the V8 API and the legacy SOAP portal if they are not in use. evidence from the advisories indicates all eight flaws can be triggered by authenticated or limited‑privilege users in certain configurations, and several involve the V8 API or legacy SOAP features. Exploitation in the wild has not been confirmed publicly for these particular vulnerabilities.
Notable CVEs and how they work
- CVE-2026-100358 (CVSS 9.4, Critical): code injection in the Studio Dropdown Editor, allowing persistent OS‑level code execution as www-data, surviving reboots and cache clears; could persist after credential theft. Evidence: described as a server‑takeover vector with persistent impact. No confirmed exploitation at present.
- CVE-2026-100363 (CVSS 8.8): privilege escalation via the V8 REST API, enabling an authenticated user to move from a low privilege to administrator‑level control of the CRM and data.
- CVE-2026-97377 (CVSS 8.8): SQL injection in the SOAP portal, potentially permitting database access or, under certain settings, remote code execution.
- Additional fixes (CVSS 7.1–6.5): API flaws enabling record overwrites and hidden field changes; SQL injection in Project Template; OAuth2 login information disclosure; and issues affecting V8 relationship actions. Exploitation status for these varies; no in‑the‑wild exploitation confirmed to date.
Impact and response
Deployments with the V8 API enabled face the broadest exposure, with five of the eight flaws tied to that API, and one vulnerability requiring no login. Organisations should patch promptly, disable unused APIs, enforce strong passwords and MFA for admins, review custom directories for rogue PHP files after patching, and apply rate limits on the OAuth2 login endpoint to deter password spraying.