EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachment ID, then call the error export endpoint to copy source rows into a downloadable CSV they own.
CVE-2026-109957
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-109957
espocrm
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "espocrm",
"product": "espocrm",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "10.0.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "10.0.7",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-109957
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #34470 · Revision 1
- Added to Heist Feed
- Publisher date