CVE-2026-109957 in EspoCRM
Summary
by MITRE • 10/13/2026
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachment ID, then call the error export endpoint to copy source rows into a downloadable CSV they own.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
EspoCRM versions prior to 10.0.7 are susceptible to an insecure direct object reference vulnerability within its import functionality. This security flaw specifically affects authenticated users who possess Import scope access, allowing them to bypass intended authorization controls and access data belonging to other users in the system. The core of the issue lies in how the application handles attachment identifiers during the import process without adequately validating whether the requesting user has permission to access the specified resource. By supplying a foreign or arbitrary attachment ID to the Import endpoint, an attacker can manipulate the backend logic to reference files that do not belong to them. This lack of proper object-level authorization check enables unauthorized data retrieval, compromising the confidentiality and integrity of sensitive information stored within the CRM platform.
The exploitation mechanism involves two primary steps that leverage specific endpoints within the application. First, the attacker creates an Import record while explicitly referencing a known attachment ID from another user's account. Because the system fails to verify ownership or permissions associated with this attachment ID during the creation phase, it accepts the reference as valid. Subsequently, the attacker invokes the error export endpoint, which is designed to generate downloadable CSV files containing source rows for debugging purposes. By triggering this endpoint after establishing the malicious import record, the application processes the request and copies the data from the referenced foreign attachment into a new file that the attacker owns and can download. This sequence effectively transforms an internal reference check failure into a direct mechanism for exfiltrating private attachments, such as documents or images uploaded by other users.
From a technical classification perspective, this vulnerability aligns with CWE-639, which describes issues related to authorization bypass through indirect object references. The attacker exploits the application's trust in user-supplied input without performing sufficient validation against an access control matrix. In terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1078, specifically Valid Accounts and potentially T1530 if viewed as data exfiltration from a cloud or on-premise application. The impact is significant for organizations relying on EspoCRM for managing sensitive client information, employee records, or proprietary business documents. Unauthorized access to these attachments can lead to privacy violations, regulatory non-compliance with standards such as GDPR or HIPAA depending on the jurisdiction and data type, and potential reputational damage due to a breach of trust among users who expect their uploaded files to remain private.
To mitigate this vulnerability, administrators must upgrade EspoCRM to version 10.0.7 or later, where the developers have implemented fixes for these authorization checks. In addition to upgrading, it is advisable to review and restrict Import scope permissions to only those users who strictly require them, adhering to the principle of least privilege. Implementing robust input validation on all endpoints that handle object identifiers can further reduce the risk of similar flaws in other parts of the application. Security teams should also monitor for unusual patterns in import activities or frequent access requests for attachments outside a user's typical scope, as these may indicate attempted exploitation of this vulnerability. Regular security audits and penetration testing focused on authorization logic are recommended to ensure that indirect object references are consistently validated against user permissions across all modules.