CVE-2026-46691 in EspoCRM
Summary
by MITRE • 10/15/2026
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that import. The endpoint performs a scope-level check but omits the entity-level ownership check enforced by the Import AccessChecker and sibling Import endpoints. This issue is fixed in version 9.3.7.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
EspoCRM, a widely deployed open-source customer relationship management platform, suffered from an insecure direct object reference vulnerability affecting versions prior to 9.3.7. The flaw resided within the API endpoint responsible for exporting import error logs, specifically POST /api/v1/Import/{id}/exportErrors. While the application implemented robust security controls such as scope-level access checks and entity-level ownership verification via an Import AccessChecker mechanism in other parts of the system, this specific endpoint failed to enforce the latter check. This inconsistency allowed authenticated users with import permissions to bypass critical data isolation boundaries by manipulating the identifier parameter in their requests.
The technical root cause was a failure to validate that the requesting user owned or had explicit permission to access the specific import record identified by the {id} parameter. By supplying an import identifier belonging to another user, an attacker could successfully retrieve an attachment ID associated with that foreign import. This attachment ID subsequently allowed the retrieval of CSV files containing detailed rows from the victim's data imports. Such exports often contain sensitive personally identifiable information or proprietary business data, making this a significant confidentiality breach despite requiring initial authentication.
From a classification perspective, this vulnerability aligns directly with CWE-639, which describes authorization bypass through direct object reference manipulation. The attack vector is consistent with MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate credentials to access resources outside the user's intended scope. Furthermore, it reflects aspects of CWE-284, Improper Access Control, where the application logic fails to enforce proper restrictions on authorized users accessing specific data objects. The operational impact includes potential exposure of confidential customer records, employee details, or financial information depending on what was contained in the imported datasets.
To mitigate this risk, organizations running EspoCRM must upgrade immediately to version 9.3.7 or later, where the endpoint logic has been corrected to include proper entity-level ownership checks. Until an upgrade is feasible, administrators should consider restricting API access through network security groups and ensuring that only trusted internal networks can reach the application interface. Additionally, implementing strict input validation on all identifier parameters passed via HTTP requests serves as a defensive measure against similar direct object reference flaws in other modules of the platform.