CVE-2026-46691
Deferred Deferred - Pending Action

Authenticated User Access to Import Errors in EspoCRM

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that import. The endpoint performs a scope-level check but omits the entity-level ownership check enforced by the Import AccessChecker and sibling Import endpoints. This issue is fixed in version 9.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-46691
EUVD
EUVD-2026-102099

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
espocrm espocrm < 9.3.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in EspoCRM versions before 9.3.7. An authenticated user with Import scope access can exploit it by sending a POST request to /api/v1/Import/{id}/exportErrors with another user's import ID. The endpoint fails to verify ownership of the import record, allowing unauthorized access to the victim's import data in CSV format.

Detection Guidance

To detect this vulnerability, check EspoCRM versions prior to 9.3.7. Verify if users with Import scope access can access unauthorized import data via POST requests to /api/v1/Import/{id}/exportErrors. Monitor logs for unusual export operations or unauthorized data retrieval attempts.

Impact Analysis

An attacker could retrieve sensitive data from other users' import jobs, including customer information or business data. This could lead to data breaches, loss of confidential information, or compliance violations depending on the data processed by the CRM.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using vulnerable versions may face compliance penalties or legal consequences.

Mitigation Strategies

Immediately upgrade EspoCRM to version 9.3.7 or later. Ensure all users follow least-privilege principles, restricting Import scope access to only necessary personnel. Review logs for past exploitation attempts and audit import/export activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46691. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart