CVE-2026-46708 in EspoCRM
Summary
by MITRE • 10/15/2026
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the target list but retrieves the target record without the required record authorization, allowing unauthorized changes to its opted_out relationship state. This issue is fixed in version 9.3.7.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
EspoCRM represents a widely utilized open-source customer relationship management platform designed to help organizations manage interactions with current and potential customers. Within this ecosystem, the TargetList module serves as a critical organizational tool for grouping contacts or leads into lists that can be shared among multiple users to facilitate coordinated marketing campaigns or outreach efforts. The security architecture of EspoCRM relies on granular access controls to ensure that users only interact with data they are explicitly permitted to view or modify based on their role and ownership permissions. However, a significant authorization flaw was identified in versions prior to 9.3.7, where the application failed to enforce proper record-level validation during specific state-change operations involving shared lists.
The core technical vulnerability lies in an improper access control mechanism within the TargetList service logic. When a low-privileged user attempts to perform actions such as opting out or canceling opt-out status for records contained within a shared TargetList, the application correctly validates that the user has permission to view the list itself. However, it fails to subsequently validate whether the individual contact or lead record is accessible to that specific user according to standard ownership and role-based permissions. The service retrieves the target record without applying the necessary record authorization checks before processing the state change. This discrepancy allows an attacker who can access a shared TargetList to manipulate the opted_out relationship state of protected contacts or leads, even if those records are otherwise restricted from their view or edit capabilities due to strict data privacy settings or organizational hierarchy rules.
This vulnerability constitutes a classic example of Insecure Direct Object Reference combined with Broken Access Control, specifically categorized under CWE-284 Improper Access Control and CWE-639 Authorization Bypass Through User-Controlled Key in the Common Weakness Enumeration framework. From an offensive security perspective, this flaw aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it allows a legitimate user to escalate their effective privileges regarding data manipulation beyond what is intended by the system administrator. The operational impact of this vulnerability includes unauthorized modification of customer communication preferences and potential exposure of sensitive personal information through indirect means. By altering opt-out statuses, an attacker could potentially bypass consent management protocols required under regulations such as GDPR or CCPA, leading to compliance violations and reputational damage for the organization deploying EspoCRM.
The resolution for this issue was implemented in version 9.3.7 of the software. The fix ensures that all state-change operations on records within a TargetList now perform rigorous authorization checks against the individual record itself, not just the list container. Organizations running affected versions must upgrade to version 9.3.7 or later immediately to mitigate this risk. In addition to applying the patch, administrators should review their access control policies and audit logs for any signs of unauthorized opt-out modifications that may have occurred prior to the update. Implementing regular security assessments and ensuring strict adherence to principle of least privilege in custom modules can further reduce the attack surface associated with such authorization bypasses.