CVE-2026-109957: EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachment ID, then call the error export endpoint to copy source rows into a downloadable CSV they own.
Affected Software
Event History
Frequently Asked Questions
Is anonymous access sufficient to exploit this issue?
No. Exploitation requires an authenticated user account with access to the Import scope.
What additional information does an attacker need?
The attacker needs a known attachment ID belonging to another user. They can supply that ID when creating an Import record, then use the error export endpoint to obtain the source rows in a downloadable CSV.
What is the impact on affected installations?
An authorized Import user can read attachments owned by other users. The stated impact is limited to confidentiality; integrity and availability are not affected.