CVE-2026-46708 Details
Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the target list but retrieves the target record without the required record authorization, allowing unauthorized changes to its opted_out relationship state. This issue is fixed in version 9.3.7.
A vulnerability in EspoCRM prior to version 9.3.7 allows low-privileged users to unauthorizedly change the opt-out status of protected contacts or leads within a shared TargetList. The issue arises because the application validates access to the TargetList but fails to enforce the necessary permissions on individual contact or lead records. As a result, users can invoke opt-out actions for records they cannot read or edit, disrupting the intended privacy controls.
Users can upgrade to EspoCRM version 9.3.7 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/espocrm/espocrm/commit/5be59190cb683d8ac50a76e96a01aa6f51b4973a | [email protected] | Source CodeVendor |
| https://github.com/espocrm/espocrm/releases/tag/9.3.7 | [email protected] | Release NotesVendor |
| https://github.com/espocrm/espocrm/security/advisories/GHSA-mqp6-23xq-7q3r | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EspoCRM | <= 9.3.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |