ESPOCRM Vulnerability Exposes Attachment Data for Authenticated Users

CVE-2026-75505

What is CVE-2026-75505?

EspoCRM, an open-source customer relationship management application, has a security vulnerability that allows an authenticated user with mass-update permissions to exploit the mass-update functionality. This flaw permits the user to provide a known attachment identifier, leading to the duplication of attachments without adequate authorization checks. As a result, sensitive file contents may be exposed through the copied attachments, thereby bypassing both record-level and field-level restrictions. While obtaining a valid attachment identifier may pose some challenge, this issue compromises user data privacy. The vulnerability has been addressed in version 10.0.2.

References