All vulnerabilities
CVE-2026-46691GHSA-rrcj-rhc2-ch5q

EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users

espocrm espocrm
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.3.7Fixed versionGitHub
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 9.3.7espocrm/espocrm, composerGitHubcomposer require "espocrm/espocrm:^9.3.7"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that import. The endpoint performs a scope-level check but omits the entity-level ownership check enforced by the Import AccessChecker and sibling Import endpoints. This issue is fixed in version 9.3.7.

Text from CVE List

Affected versions 2

  • espocrmaffected: < 9.3.7CVE List
  • espocrm/espocrm, composer<= 9.3.6GitHub

References 3