The V8 module API exposes CRUD operations for administrator‑only modules to any authenticated OAuth2 user, and it fails to enforce ACL checks on the ACLRoles, ACLActions, and Administration endpoints. A low‑privileged user can supply crafted data to these endpoints, creating new roles, changing ACL levels, binding elevated roles, and altering global configuration. This effectively grants the attacker administrator‑equivalent control over all CRM data and system behavior.

SuiteCRM SuiteCRM versions prior to 7.15.2 and 8.10.2 are affected when the V8 REST interface is enabled. The vulnerability is fixed in releases 7.15.2, 8.10.2, and later versions.

The CVSS score is 8.8, indicating a high severity vulnerability. EPSS information is unavailable, and the issue is not listed in the CISA KEV catalog. Because the flaw can be triggered by any authenticated OAuth2 user via the /Api/V8/module endpoint, the attack vector is remote and does not require local system access. An attacker needs only a valid user account with normal privileges to craft the requests that modify ACL settings and global configuration.