Insecure Direct Object Reference in EspoCRM Affects User Attachment Privacy

CVE-2026-109957

What is CVE-2026-109957?

EspoCRM versions prior to 10.0.7 are vulnerable to an insecure direct object reference, allowing authenticated users with Import scope access to retrieve attachments belonging to other users. By exploiting this vulnerability, an attacker can manipulate the Import endpoint by entering a foreign attachment ID, enabling them to create an Import record that references the attachment. Subsequently, the attacker can invoke the error export endpoint, resulting in the unauthorized extraction of data into a downloadable CSV file.

References