EspoCRM IDOR Vulnerability Advisory GHSA-5729-xq64-4h22

Vulnerability Overview Vulnerability Name: IDOR allowing users with access to Import scope to extract data from attachments with known ID Vulnerability Type: IDOR (Insecure Direct Object Reference) Severity: 4.3 / 10 (Moderate) CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: Low - User interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: None - Availability: None Scope Affected Versions: <= 10.0.6 Fixed Version: 10.0.7 Remediation Fixed Version: Upgrade to version 10.0.7 or higher Detailed Description Summary: - An authentication authorization bypass vulnerability was discovered in the import workflow of EspoCRM. - accepts a caller-controlled , but the backend does not verify whether the current user has permission to open the attachment before reading it from storage. - An attacker can use another user's attachment ID to create their own import record. After creating the import record, the attacker can invoke the erroneous export endpoint on their import record. EspoCRM will re-open the original source attachment and copy the new downloadable CSV attachment within the file, attaching it to the attachment owned by the attacker. - This allows a low-privileged authenticated user to disclose the content of another user's attachments when the attachment ID is known. Credit Reporter: @kaizhi888 Weaknesses CWE-639 CWE-862 Credits Reporter: kaizhi888 Additional Information CVE ID: No known CVE CVSS v3 base metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Page Link GitHub Link: https://github.com/espocrm/espocrm/security/advisories/GHSA-5729-xq64-4h22 Footer Information Copyright: © 2026 GitHub, Inc. Links: Terms, Privacy, Security, Status, Community, Docs, Contact, Manage cookies, Do not share my personal information Navigation Bar Platform: Platform Solutions: Solutions Resources: Resources Open Source: Open Source Enterprise: Enterprise Pricing: Pricing User Actions Sign in: Sign in Sign up: Sign up Search Search Box: [Search Icon] Page Tabs Code: Code Issues: Issues 48 Pull requests: Pull requests 15 Actions: Actions Security and quality: Security and quality 37 Insights: Insights Page Breadcrumbs espocrm / espocrm espocrm / Security / Advisories / GHSA-5729-xq64-4h22 Page Title IDOR allowing users with access to Import scope to extract data from attachments with known ID Page Description Moderate yurikuzn published GHSA-5729-xq64-4h22 2 weeks ago Page Content Package: espocrm/espocrm Affected versions: <= 10.0.6 Patched versions: 10.0.7 Page Right Sidebar Severity: 4.3 / 10 Moderate CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: Low - User interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: None - Availability: None Learn more about base metrics CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE ID: No known CVE Weaknesses: - CWE-639 - CWE-862 Credits: - kaizhi888 - Reporter Page Bottom © 2026 GitHub, Inc. Terms Privacy Security Status Community Docs Contact Manage cookies Do not share my personal information Page Top Platform Solutions Resources Open Source Enterprise Pricing Sign in Sign up Search Box Page Middle espocrm / espocrm Code Issues 48 Pull requests 15 Actions Security and quality 37 Insights Page Left Sidebar espocrm / Security / Advisories / GHSA-5729-xq64-4h22 IDOR allowing users with access to Import scope to extract data from attachments with known ID Moderate yurikuzn published GHSA-5729-xq64-4h22 2 weeks ago Package: espocrm/espocrm Affected versions: <= 10.0.6 Patched versions: 10.0.7 Description Summary Credit: @kaizhi888 Page Right Sidebar Severity: 4.3 / 10 Moderate CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: Low - User interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: None - Availability: None Learn more about base metrics CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE ID: No known CVE Weaknesses: - CWE-639 - CWE-862 Credits: - kaizhi888 - Reporter Page Bottom © 2026 GitHub, Inc. Terms Privacy Security Status Community Docs Contact Manage cookies Do not share my personal information Page Top Platform Solutions Resources Open Source Enterprise Pricing Sign in Sign up Search Box Page Middle espocrm / espocrm Code Issues 48 Pull requests 15 Actions Security and quality 37 Insights Page Left Sidebar espocrm / Security / Advisories / GHSA-5729-xq64-4h22 IDOR allowing users with access to Import scope to extract data from attachments with known ID Moderate yurikuzn published GHSA-5729-xq64-4h22 2 weeks ago Package: espocrm/espocrm Affected versions: <= 10.0.6 Patched versions: 10.0.7 Description Summary Credit: @kaizhi888 Page Right Sidebar Severity: 4.3 / 10 Moderate CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: Low - User interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: None - Availability: None Learn more a

Goal Reached Thanks to every supporter — we hit 100%!

EspoCRM IDOR Vulnerability Advisory GHSA-5729-xq64-4h22

More from this source