CVE-2026-33740 Details
Description
EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Email/importEml endpoint contains an Insecure Direct Object Reference (IDOR) vulnerability where the attacker-supplied fileId parameter is used to fetch any attachment directly from the repository without verifying that the current user has authorization to access it. Any authenticated user with Email:create and Import permissions can exploit this to read another user's .eml attachment contents by importing them as a new email into the attacker's mailbox, while the original victim attachment record is deleted as a side effect of the import flow. This is inconsistent with the standard attachment download path, which enforces ACL checks before returning file data, and is practically exploitable because attachment IDs are commonly exposed in normal UI and API workflows such as stream payloads and download links. This issue is fixed in version 9.3.4.
A cross-user Insecure Direct Object Reference (IDOR) vulnerability has been identified in EspoCRM versions through 9.3.3. The issue arises in the POST /api/v1/Email/importEml endpoint, where the fileId parameter, supplied by the attacker, is used to fetch attachments without proper authorization checks. This allows authenticated users with Email:create and Import permissions to access and import another user's .eml attachment into their mailbox, while simultaneously deleting the original attachment record from the victim. The vulnerability exists because attachment IDs are often exposed in the application's user interface and API responses, making it easy to exploit.
Users are advised to update to EspoCRM version 9.3.4, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/espocrm/espocrm/commit/88e3ba6a7b5cab5dbc2298e2a093d3aa383aa95f | [email protected] | Patch |
| https://github.com/espocrm/espocrm/releases/tag/9.3.4 | [email protected] | Release Notes |
| https://github.com/espocrm/espocrm/security/advisories/GHSA-wr7j-hxf8-hc4w | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| espocrm espocrm | < 9.3.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 13, 2026 | New CVE Received | [email protected] |