EspoCRM up to 9.3.3 Endpoint /api/v1/Email/importEml fileId authorization

Summaryinfo

A vulnerability classified as critical was found in EspoCRM up to 9.3.3. Impacted is an unknown function of the file /api/v1/Email/importEml of the component Endpoint. The manipulation of the argument fileId results in authorization. This vulnerability is reported as CVE-2026-33740. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in EspoCRM up to 9.3.3. It has been classified as critical. Affected is an unknown function of the file /api/v1/Email/importEml of the component Endpoint. The manipulation of the argument fileId with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Email/importEml endpoint contains an Insecure Direct Object Reference (IDOR) vulnerability where the attacker-supplied fileId parameter is used to fetch any attachment directly from the repository without verifying that the current user has authorization to access it. Any authenticated user with Email:create and Import permissions can exploit this to read another user's .eml attachment contents by importing them as a new email into the attacker's mailbox, while the original victim attachment record is deleted as a side effect of the import flow. This is inconsistent with the standard attachment download path, which enforces ACL checks before returning file data, and is practically exploitable because attachment IDs are commonly exposed in normal UI and API workflows such as stream payloads and download links. This issue is fixed in version 9.3.4.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-33740 since 03/23/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available.

Upgrading to version 9.3.4 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 88e3ba6a7b5cab5dbc2298e2a093d3aa383aa95f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• EspoCRM

Version

• 9.3.0
• 9.3.1
• 9.3.2
• 9.3.3

License

• open-source

Website

• Product: https://github.com/espocrm/espocrm/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion