CVE-2026-46694 Details
Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hide notes whose isInternal field is true, but the direct single-Note access check does not enforce that restriction, exposing internal agent content. This issue is fixed in version 9.3.7.
A vulnerability exists in EspoCRM versions prior to 9.3.7, allowing portal users with stream access to a parent record to bypass access controls and read internal notes through the portal Note API. While stream list responses appropriately conceal internal notes, the direct access check fails to apply the same restriction, exposing confidential agent content. To exploit this vulnerability, a user must know the specific note ID.
Users can upgrade to EspoCRM version 9.3.7 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/espocrm/espocrm/commit/ee039bd22da9b6f5b768f31e7acece36596befb2 | [email protected] | Source CodeVendor |
| https://github.com/espocrm/espocrm/releases/tag/9.3.7 | [email protected] | Release NotesVendor |
| https://github.com/espocrm/espocrm/security/advisories/GHSA-cg9f-34hj-p238 | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EspoCRM | <= 9.3.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |