PT-2026-114976 · Espocrm · Espocrm
CVE-2026-75505
·
Published
2026-10-15
·
Updated
2026-10-15
CVSS v4.0
6.0
Medium
| Vector | AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
EspoCRM versions prior to 10.0.2
Description
An authenticated user with mass-update permissions can exploit the mass-update functionality by providing a known attachment identifier. The mass-update processor duplicates the attachment without verifying if the user has the necessary read permissions, which bypasses record-level and field-level restrictions and exposes the contents of the file via the duplicated attachment.
Recommendations
Update to version 10.0.2.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Espocrm