CVE-2026-75505— EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment
Quick assessment
Affected
espocrm espocrm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
EspoCRM 是一款开源的客户关系管理（CRM）应用程序。在 10.0.2 版本之前，拥有批量更新权限的已认证用户可以向批量更新功能提供一个已知的附件标识符。批量更新处理器在复制附件时未校验调用者是否具备读取该附件的权限，从而绕过了记录级和字段级的访问限制，导致文件内容可通过复制后的附件被暴露。获取有效的附件标识符可能较为困难。该问题已在 10.0.2 版本中得到修复。
Possible ATT&CK Techniques 1 AI
T1135 · Network Share Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75505
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment
Source: CVE Program / CVE List V5
Vulnerability Description
EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the caller can read it, bypassing record-level and field-level restrictions and exposing the file contents through the copied attachment. Obtaining a valid attachment identifier may be difficult. This issue is fixed in version 10.0.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-75505
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75505
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-75505 (1)
Vendor Advisories for CVE-2026-75505 (1)
Vendor Pages for CVE-2026-75505 (1)
-
Release 10.0.2 · espocrm/espocrm · GitHub x_refsource_MISC
Same Patch Batch · espocrm · 2026-10-15 · 12 CVEs total
| CVE-2026-47168 | 9.1 CRITICAL | EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export para |
| CVE-2026-53574 | 7.6 HIGH | EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression |
| CVE-2026-46691 | 6.5 MEDIUM | EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users |
| CVE-2026-46694 | 6.5 MEDIUM | EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes |
| CVE-2026-77460 | 6.5 MEDIUM | EspoCRM: Mass email template renderer leaks restricted record fields |
| CVE-2026-63130 | 5.5 MEDIUM | EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.jso |
| CVE-2026-55154 | 5.4 MEDIUM | EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters |
| CVE-2026-46708 | 4.3 MEDIUM | EspoCRM: Target list Opt-Out actions allows opting out record without access Target List a |
| CVE-2026-59994 | 4.3 MEDIUM | EspoCRM: Pre-authentication stored HTML injection in stream notification emails about emai |
| CVE-2026-55184 | 3.5 LOW | EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled |
| CVE-2026-53575 | 2.7 LOW | EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user |
IV. Related Vulnerabilities
Same product: espocrm
-
CVE-2026-77460
EspoCRM: Mass email template renderer leaks restricted recor -
CVE-2026-63130
EspoCRM: Admin path traversal in LabelManager (Custom Label -
CVE-2026-59994
EspoCRM: Pre-authentication stored HTML injection in stream -
CVE-2026-55154
EspoCRM: CSV/Formula Injection sanitizer bypass via leading -
CVE-2026-55184
EspoCRM: Stored XSS in wysiwyg template fields if CSP is dis
Same vendor: espocrm
-
CVE-2026-77460
EspoCRM: Mass email template renderer leaks restricted recor -
CVE-2026-63130
EspoCRM: Admin path traversal in LabelManager (Custom Label -
CVE-2026-59994
EspoCRM: Pre-authentication stored HTML injection in stream -
CVE-2026-55154
EspoCRM: CSV/Formula Injection sanitizer bypass via leading -
CVE-2026-55184
EspoCRM: Stored XSS in wysiwyg template fields if CSP is dis
Same weakness: CWE-862
-
CVE-2026-111353
Peppermint through 0.5.5 Missing Authorization via Time-Trac -
CVE-2026-111350
Papermark through 0.22.0 Missing Authorization in Data Room -
CVE-2026-111349
Craftplan through 0.7.5 Missing Authorization via CRM Custom -
CVE-2026-111343
pig through 4.1.1 Missing Authorization via GET /admin/user/ -
CVE-2026-111277
NivoCart through 2.5.1 Guest Order Invoice Disclosure via ac
V. Comments for CVE-2026-75505
No comments yet