https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-09T14:33:56.993633+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-100360 CVE-2026-100360 — SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record 2026-11-09T14:33:56.995850+00:00

Affected: SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records. In the verified Account-to-Contact case, an authenticated user can create a relationship while unable to edit the Account and can delete relationship links to a hidden Contact that cannot be viewed directly. This issue is fixed in versions 7.15.2 and 8.10.2.