CVE-2026-46691: EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that import. The endpoint performs a scope-level check but omits the entity-level ownership check enforced by the Import AccessChecker and sibling Import endpoints. This issue is fixed in version 9.3.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 9.3.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated EspoCRM user needs Import scope access. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What information can be exposed?
An attacker who supplies another user's import identifier can obtain an attachment identifier for a CSV containing rows from that user's import. The issue affects confidentiality; no integrity or availability impact is described.
Which versions are affected and what is the remediation?
EspoCRM versions prior to 9.3.7 are affected. Upgrade to version 9.3.7, which fixes the missing entity-level ownership check.