CVE-2026-46694 EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hid...