CVE-2026-75505
Deferred Deferred - Pending Action

Authenticated Mass Update Attachment Exposure in EspoCRM

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the caller can read it, bypassing record-level and field-level restrictions and exposing the file contents through the copied attachment. Obtaining a valid attachment identifier may be difficult. This issue is fixed in version 10.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-75505
EUVD
EUVD-2026-102111

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
espocrm espocrm < 10.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects EspoCRM versions up to 10.0.1. An authenticated user with mass-update permissions can exploit a flaw to read any attachment in the system by supplying a known attachment identifier. The mass-update feature duplicates the attachment without verifying the user's read access, bypassing record and field-level restrictions.

Detection Guidance

To detect this vulnerability, check if your EspoCRM instance is running a version prior to 10.0.2. Review system logs for unusual mass-update operations or unauthorized attachment access attempts. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive file contents stored in the CRM. Attackers with mass-update permissions could view attachments they are not permitted to access, potentially exposing confidential data.

Mitigation Strategies

Immediately upgrade EspoCRM to version 10.0.2 or later to patch the vulnerability. Ensure only trusted users have mass-update permissions. Monitor for suspicious activity related to attachment access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75505. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart