CVE-2026-46691

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...

CVE-2026-46691

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...

CVE-2026-46691 EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...

CVE-2026-46691

The open-source CRM EspoCRM contains an Insecure Direct Object Reference (IDOR) vulnerability in the POST /api/v1/Import/{id}/exportErrors endpoint in versions prior to 9.3.7 . While the endpoint performs a scope-level check, it fails to perform the entity-level ownership check required by the Im...

PT-2026-114954

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...

CVE-2026-46691: Missing Authorization

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...

CVE-2026-109957 EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachme...

CVE-2026-109957: Authorization Bypass Through User-Controlled Key

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachme...

PT-2026-111552

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 10.0.7 Description An insecure direct object reference allows authenticated users with Import scope access to read attachments belonging to other users. This occurs when a foreign attachmentId is supplied to the Impor...