CVE-2026-75505 Details
Description
EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the caller can read it, bypassing record-level and field-level restrictions and exposing the file contents through the copied attachment. Obtaining a valid attachment identifier may be difficult. This issue is fixed in version 10.0.2.
A vulnerability in EspoCRM's mass update feature allows authenticated users with mass update permissions to bypass attachment access controls. This issue is present in EspoCRM versions through 10.0.1. The vulnerability enables users to duplicate attachments by supplying a known attachment ID, without proper authorization to read the original file. This bypasses both record-level and field-level permissions, exposing the attachment's contents through the copied file. The vulnerability arises from the mass update processor's failure to verify whether the user has the right to access the specified attachment, particularly in relation to field-level restrictions. While the vulnerability could lead to unauthorized access to sensitive files, obtaining a valid attachment ID may be challenging, adding complexity to potential exploitation.
Users can upgrade to EspoCRM version 10.0.2 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/espocrm/espocrm/commit/5be3e7ef2a010c151551a8bc277e9ca61e1503d4 | [email protected] | Source CodeVendor |
| https://github.com/espocrm/espocrm/releases/tag/10.0.2 | [email protected] | Release NotesVendor |
| https://github.com/espocrm/espocrm/security/advisories/GHSA-24pg-2q7q-m5p6 | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EspoCRM | <= 10.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |