CVE-2026-46691: medium-severity vulnerability in espocrm
EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users
Published
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5
exploitation probability
—
observed exploitation
nono source reports it
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that import. The endpoint performs a scope-level check but omits the entity-level ownership check enforced by the Import AccessChecker and sibling Import endpoints. This issue is fixed in version 9.3.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
espocrm · espocrmRelated CVEs — espocrm
In the same product, most dangerous first.
CVE-2026-33534MEDIUMEspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notationEPSS 1.7%CVE-2025-52575MEDIUMEspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special ElementsEPSS 0.7%CVE-2024-24818MEDIUMEspoCRM weakness in "Forgot password"EPSS 0.6%CVE-2026-33733HIGHEspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and deleteEPSS 0.6%CVE-2026-33656CRITICALEspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin userEPSS 0.6%CVE-2025-32789LOWEspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting FunctionEPSS 0.4%