# CVE-2026-63111: SuiteCRM authorization bypass in V8 API SchedulersJobs

Source: https://junglewise.ai/threats/cve-2026-63111-suitecrm-is-an-open-source-enterprise-ready-customer-relationship  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-63111 · Severity: info · Published 2026-11-05

SuiteCRM is an open-source CRM system used to manage customer relationships and business data. A low-privileged user can bypass authorization checks in the V8 API to create malicious scheduled jobs that execute with system-level privileges, potentially allowing an attacker to make unauthorized requests to internal systems, expose sensitive services, or maintain persistent access through recurring tasks.

Technologies: [SuiteCRM](https://junglewise.ai/threats/technologies/suitecrm-suitecrm). Vendors: [SuiteCRM](https://junglewise.ai/threats/vendors/suitecrm).

## Quick answers

**Is CVE-2026-63111 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63111 being exploited in the wild.

**How severe is CVE-2026-63111?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** SuiteCRM prior to 7.15.2 and 8.10.2.

**Is there a fix for CVE-2026-63111?** Yes: fixed in 7.15.2, 8.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63111 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63111?** Check whether you run SuiteCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.15.2, 8.10.2

## Technical details

The V8 module API endpoint /Api/V8/module lacks module-level authorization checks, allowing low-privileged users to create SchedulersJobs records with attacker-controlled target values. The cron.php scheduler later executes these jobs with system privileges, and the url:: target handler can make server-side requests to internal or external hosts, follow redirects, and persist as recurring jobs. An attacker gains the ability to probe internal services, interact with restricted endpoints, and establish persistent automated attack footprints.

## Affected products

- SuiteCRM SuiteCRM prior to 7.15.2 and 8.10.2

## Timeline

- 2026-11-05: disclosed
- 2026-07-29: patched

## References

- [https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68](https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68)
- [https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2](https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2)

## Related threats

- [SuiteCRM SQL injection in SOAP portal API](https://junglewise.ai/threats/cve-2026-97377-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM path traversal in workflow controller](https://junglewise.ai/threats/cve-2026-71550-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM SQL injection in report query builder](https://junglewise.ai/threats/cve-2026-71548-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM SQL injection in AOR report generation](https://junglewise.ai/threats/cve-2026-69145-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM download authorization bypass in document access](https://junglewise.ai/threats/cve-2026-69144-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)