CVE-2026-113643

Deferred Deferred - Pending Action

Authorization Bypass in EspoCRM PDF Rendering

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulDB

Description

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113643

EUVD

EUVD-2026-105252

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	EspoCRM	9.3.0
n/a	EspoCRM	9.3.1
n/a	EspoCRM	9.3.2
n/a	EspoCRM	9.3.3
n/a	EspoCRM	9.3.4
n/a	EspoCRM	9.3.5
n/a	EspoCRM	9.3.6
n/a	EspoCRM	9.3.7
n/a	EspoCRM	9.3.8
n/a	EspoCRM	9.3.9
n/a	EspoCRM	9.3.10
n/a	EspoCRM	10.0.0
n/a	EspoCRM	10.0.1
n/a	EspoCRM	10.0.2
n/a	EspoCRM	10.0.3
n/a	EspoCRM	10.0.4
n/a	EspoCRM	10.0.5
n/a	EspoCRM	10.0.6
n/a	EspoCRM	10.0.7
n/a	EspoCRM	10.0.8
n/a	EspoCRM	10.0.9
n/a	EspoCRM	10.0.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects EspoCRM versions up to 9.3.10/10.0.10. It involves an authorization bypass in the PDF rendering pipeline where manipulating the ID argument in the ImageSourceProvider::get function allows remote attackers to access unauthorized image attachments. The issue stems from improper access control in PDF template image handling.

Detection Guidance

To detect this vulnerability, check if your EspoCRM version is below 9.3.10 or 10.0.10. Inspect the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php for the ImageSourceProvider::get function. Verify if the patch 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2 is applied. Look for unauthorized access attempts to image attachments in PDF templates.

Impact Analysis

An attacker with edit access to PDF templates could exploit this to view sensitive image attachments they are not authorized to access. This could lead to unauthorized data exposure, including confidential customer or business information stored in attachments.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access to sensitive personal or health data. Organizations using affected EspoCRM versions may face regulatory penalties or reputational damage due to data breaches.

Mitigation Strategies

Immediately update EspoCRM to version 10.1.0 or later. Apply the patch 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2 if upgrading is not possible. Review and restrict access to PDF template scopes to prevent unauthorized users from embedding image references. Monitor for any suspicious activity related to image attachment access.

Hi! I’m here to help you understand CVE-2026-113643. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...