CVE-2026-46708— EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record

Quick assessment

Copy summary Copy citation

Affected

espocrm espocrm

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

EspoCRM 是一款开源客户关系管理（CRM）应用程序。在 9.3.7 版本之前，具备较低权限的用户如果能够访问一个共享的“目标列表”（TargetList），便可以对该用户无权读取或编辑的受保护“联系人”（Contact）或“潜在客户”（Lead）执行“退订”（opt-out）或“取消退订”（cancel-opt-out）操作。该服务虽然会验证用户对目标列表的访问权限，但在获取目标记录时未进行必要的记录级授权检查，从而导致攻击者可以未经授权地修改其“已退订”（opted_out）关系状态。该问题已在 9.3.7

CVE-2026-46708 affects espocrm espocrm. No confirmed in-the-wild exploitation; assess based on exposure. EspoCRM 是一款开源客户关系管理（CRM）应用程序。在 9.3.7 版本之前，具备较低权限的用户如果能够访问一个共享的“目标列表”（TargetList），便可以对该用户无权读取或编辑的受保护“联系人”（Contact）或“潜在客户”（Lead）执行“退订”（opt-out）或“取消退订”（cancel-opt-out）操作。该服务虽然会验证用户对目标 CVE-2026-46708 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-46708

I. Basic Information for CVE-2026-46708

Affected Products

II. Public POCs for CVE-2026-46708

III. Intelligence Information for CVE-2026-46708

Patches & Fixes for CVE-2026-46708 (1)

• Fix opt out · espocrm/espocrm@5be5919 · GitHub x_refsource_MISC

Vendor Advisories for CVE-2026-46708 (1)

• Target list Opt-Out actions allow opting out record without edit access to Target List · Advisory · espocrm/espocrm · GitHub x_refsource_CONFIRM

Vendor Pages for CVE-2026-46708 (1)

• Release 9.3.7 · espocrm/espocrm · GitHub x_refsource_MISC

• https://www.cve.org/CVERecord?id=CVE-2026-46708

Same Patch Batch · espocrm · 2026-10-15 · 12 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-46708