CVE-2026-46708
Deferred Deferred - Pending Action

Stored Opt-Out Manipulation in EspoCRM

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the target list but retrieves the target record without the required record authorization, allowing unauthorized changes to its opted_out relationship state. This issue is fixed in version 9.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-46708
EUVD
EUVD-2026-102098

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
espocrm espocrm < 9.3.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-46708 is an authorization bypass vulnerability in EspoCRM versions 9.3.6 and earlier. A low-privileged user with access to a shared TargetList can change the opted-out status of contacts or leads they cannot read or edit. The system checks TargetList access but fails to verify record-level permissions for the target entity, allowing unauthorized modifications.

Detection Guidance

Check EspoCRM version with: grep -r "version" /path/to/espocrm/config.php. If version is 9.3.6 or earlier, the system is vulnerable. Review TargetList shared access logs for unauthorized opt-out or cancel-opt-out actions on Contacts or Leads.

Impact Analysis

This vulnerability allows unauthorized users to alter the opted-out status of contacts or leads. This could lead to unintended communication with users who have opted out, potentially violating privacy expectations or causing reputational damage. The impact is limited to data integrity within the opted_out relationship state.

Mitigation Strategies

Upgrade EspoCRM to version 9.3.7 or later immediately. Review and restrict shared TargetList permissions to prevent unauthorized access. Audit recent opt-out status changes for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46708. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart