Authorization Bypass in EspoCRM Affects User Data Access

CVE-2026-46691

What is CVE-2026-46691?

EspoCRM, an open-source customer relationship management platform, contains a vulnerability that allows authenticated users with Import scope access to exploit the /api/v1/Import/{id}/exportErrors endpoint. By leveraging this endpoint, these users can retrieve sensitive attachment identifiers for CSV files related to other users' import processes. This oversight occurs because, while a scope-level check is performed, the necessary entity-level ownership validation is absent. As a result, an unauthorized user could access critical import errors associated with another user's data. This vulnerability is resolved in version 9.3.7.

References