Insecure Direct Object Reference in EspoCRM Open Source CRM Application

CVE-2026-33740

What is CVE-2026-33740?

EspoCRM, an open source customer relationship management application, suffers from an Insecure Direct Object Reference vulnerability in its Email import functionality. Specifically, the vulnerability exists in the POST /api/v1/Email/importEml endpoint, where the attacker can exploit the fileId parameter to retrieve any user's .eml attachment without verifying access rights. This allows any authenticated user with the appropriate permissions to read other users' email contents by importing them into their own mailbox, leading to unauthorized data exposure. The exploitation is facilitated by the frequent visibility of attachment IDs, which can be accessed through standard user interface and API workflows. The issue has been addressed in version 9.3.4.

References