| Title | EspoCRM 10.0.9 Improper Access Control |
|---|
| Description | An Insecure Direct Object Reference (IDOR) vulnerability in EspoCRM's PDF rendering pipeline allows any authenticated low-privileged user with access to the PDF Templates scope to exfiltrate image attachments belonging to other users without having read permission to those files.
The vulnerable file is application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php. The method get(string $id) fetches an attachment entity by user-supplied ID and validates only the MIME type via checkTypeImage(), without performing any ACL check to verify whether the requesting user is authorized to access that attachment.
When generating a PDF, HtmlComposer::replaceTags() resolves inline image references matching src="?entryPoint=attachment&id=<ID>" via ImageSourceProvider::get(). The resolved content is embedded as data:image/jpeg;base64,... directly in the PDF output. An attacker can place an arbitrary attachment ID in a PDF template body and generate a PDF against any record they legitimately access, causing the victim's image content to be embedded in the resulting PDF and downloaded.
This is inconsistent with every other attachment resolution point in the codebase (Tools/Import/Import.php, Tools/Email/Api/PostImportEml.php, Tools/Pdf/Util/Validation.php, Classes/FieldDuplicators/Wysiwyg.php, Tools/MassUpdate/Processor.php), all of which perform checkEntityRead() or owner checks before returning attachment data.
Proof of Concept:
1. Create a low-privileged user with PDF Templates (read: all) and Leads (read: own) permissions, no access to victim attachments.
2. As attacker, create a PDF Template with Entity Type Lead and Body: <img src="?entryPoint=attachment&id=VICTIM_ATTACHMENT_ID"/>
3. As attacker, open any Lead record, click Print to PDF, select the malicious template and download the PDF.
4. The PDF contains the victim's image as base64. Decode with: strings output.pdf | grep -o 'base64,[^"]*' | head -1 | cut -d',' -f2 | base64 -d > exfiltrated.jpg
The vendor was contacted via GitHub private security advisory (GHSA-w46f-mj7x-v5c6) and acknowledged the issue, stating it will be fixed in the future.
Affected targets: user avatars, company logos, inline images in WYSIWYG fields, document attachments, and image-type custom fields.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-639: Authorization Bypass Through User-Controlled Key |
|---|
| Source | ⚠️ https://github.com/espocrm/espocrm/security/advisories/GHSA-w46f-mj7x-v5c6 |
|---|
| User | spoo1k (UID 101695) |
|---|
| Submission | 10/02/2026 04:01 (1 month ago) |
|---|
| Moderation | 10/20/2026 15:53 (18 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422794 [EspoCRM up to 9.3.10/10.0.10 PDF Rendering Pipeline ImageSourceProvider.php ImageSourceProvider::get id authorization] |
|---|
| Points | 20 |
|---|