Access Control Flaw in EspoCRM Opens Unauthorized Modification Risks

CVE-2026-46708

What is CVE-2026-46708?

EspoCRM, an open-source customer relationship management application, has a significant access control vulnerability that permits low-privileged users to perform unauthorized actions on sensitive data. Specifically, users with access to a shared TargetList can inaccurately invoke opt-out or cancel-opt-out actions for Contacts or Leads they are not authorized to access. This vulnerability arises from inadequate authorization checks during the retrieval of target records, allowing manipulation of the opted_out relationship status. It is crucial for users running versions prior to 9.3.7 to upgrade their installations to mitigate this risk.

References