CVE-2026-75505 in EspoCRM
Summary
by MITRE • 10/15/2026
EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the caller can read it, bypassing record-level and field-level restrictions and exposing the file contents through the copied attachment. Obtaining a valid attachment identifier may be difficult. This issue is fixed in version 10.0.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
EspoCRM represents a widely deployed open-source customer relationship management platform designed to help organizations manage interactions with current and potential customers. Within this ecosystem, the application enforces strict access controls through record-level and field-level permissions to ensure that users can only view or modify data for which they have explicit authorization. These security mechanisms are fundamental to maintaining data integrity and confidentiality in multi-tenant environments where sensitive business information is stored. However, prior to version 10.0.2, a critical flaw existed within the mass-update functionality of the application that undermined these access controls by allowing an authenticated user with specific update privileges to bypass restrictions on file attachments.
The technical vulnerability stems from how the mass-update processor handles attachment identifiers when duplicating records or fields. When a user initiates a mass update operation and supplies a known identifier for an existing attachment, the system attempts to duplicate that attachment into the new record context. The core flaw lies in the fact that this duplication process does not perform adequate authorization checks against the original source of the attachment. Specifically, the processor fails to verify whether the calling user has read permissions for the file associated with the provided identifier. Consequently, if an attacker can obtain a valid attachment identifier through other means, they can leverage the mass-update feature to create a copy of that restricted file in a location where they have write access or visibility, effectively circumventing both record-level and field-level security restrictions.
This behavior constitutes an Insecure Direct Object Reference vulnerability, classified under CWE-639, as it involves accessing a resource using a direct reference such as a database key without proper authorization checks on the target object itself. Furthermore, this flaw aligns with ATT&CK technique T1074.002, Local Data Staging, because the attacker uses legitimate system functionality to copy sensitive data into a controlled location for potential exfiltration or further exploitation. The operational impact is significant in environments where EspoCRM hosts confidential documents such as contracts, financial records, or personal identifiable information belonging to other users who should not have access to them based on their role or departmental boundaries.
Although the vulnerability requires authentication and specific permissions related to mass-updates, it poses a serious risk because authenticated insiders with limited privileges can escalate their effective access rights regarding file data. The difficulty in obtaining valid attachment identifiers serves as a partial mitigating factor, reducing the likelihood of automated exploitation by external attackers who lack initial access or knowledge of internal object IDs. However, for malicious users within the organization or those who have gained foothold through other vectors such as credential theft or session hijacking, this flaw provides a reliable method to leak sensitive documents without triggering typical audit alerts associated with direct file downloads from restricted areas.
The issue was addressed in version 10.0.2 of EspoCRM by implementing proper authorization checks within the mass-update processor. The fix ensures that before an attachment is duplicated or referenced, the system verifies that the requesting user has explicit read permissions for the source attachment. This correction restores the integrity of the access control model and prevents unauthorized users from leveraging administrative features to bypass security boundaries. Organizations running affected versions should upgrade immediately to mitigate this risk. Additionally, administrators are advised to review mass-update permission assignments carefully, ensuring that only trusted personnel with a legitimate business need can execute bulk operations on records containing sensitive attachments. Regular auditing of user permissions and monitoring for unusual patterns in file duplication activities can further enhance security posture against such logic-based vulnerabilities.