4 matches found
CVE-2026-46691
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...
CVE-2026-46691
The open-source CRM EspoCRM contains an Insecure Direct Object Reference (IDOR) vulnerability in the POST /api/v1/Import/{id}/exportErrors endpoint in versions prior to 9.3.7 . While the endpoint performs a scope-level check, it fails to perform the entity-level ownership check required by the Im...
CVE-2026-46691 EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...
EUVD-2026-102099
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...