CVE-2026-109957: EspoCRM IDOR Information Disclosure Flaw

CVE-2026-109957 Overview

CVE-2026-109957 is an insecure direct object reference (IDOR) vulnerability in EspoCRM versions prior to 10.0.7. Authenticated users holding Import scope access can read attachments belonging to other users by supplying a foreign attachmentId to the Import endpoint. An attacker creates an Import record that references a known attachment identifier, then calls the error export endpoint to copy source rows into a downloadable CSV owned by the attacker. The flaw is tracked under CWE-639: Authorization Bypass Through User-Controlled Key and documented in the GitHub Security Advisory GHSA-5729-xq64-4h22.

Critical Impact
Authenticated users with Import privileges can exfiltrate attachment contents belonging to other EspoCRM users through the error export flow.

Affected Products

EspoCRM versions before 10.0.7
EspoCRM deployments where users are granted Import scope access
Self-hosted and cloud-hosted EspoCRM instances exposing the Import API

Discovery Timeline

2026-10-13 - CVE-2026-109957 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109957

Vulnerability Analysis

The vulnerability resides in the Import workflow of EspoCRM. The Import endpoint accepts an attachmentId parameter from the authenticated user without verifying that the submitted attachment belongs to the requesting user or their accessible scope. An authorized user can therefore pass any attachment identifier known or guessed to belong to another user. The downstream error export routine then processes the referenced attachment and writes selected rows into a new CSV file that is owned by the attacker. This creates a cross-tenant data read primitive gated only by Import scope privileges.

Root Cause

The root cause is missing object-level authorization in the Import endpoint. EspoCRM trusts the attachmentId supplied by the client without validating ownership or ACL applicability against the authenticated user. This is a textbook broken access control pattern aligned with CWE-639, where authorization decisions depend on a user-controlled key.

Attack Vector

Exploitation requires a valid EspoCRM account with Import scope access and a target attachmentId. The attacker issues an API call to create an Import job that references the victim's attachment identifier. The attacker then invokes the error export endpoint, which copies rows from the referenced source attachment into a CSV the attacker can download. No user interaction from the victim is required, and the attack is executed over the network against the standard EspoCRM API surface.

Refer to the VulnCheck EspoCRM IDOR Advisory for additional technical context.

Detection Methods for CVE-2026-109957

Indicators of Compromise

Import records created with attachmentId values that do not correspond to attachments uploaded by the same user account.
Repeated calls to the Import creation endpoint followed by calls to the error export endpoint from a single user session.
Unexpected CSV downloads via the error export endpoint containing data from unrelated business records.

Detection Strategies

Audit EspoCRM application logs for Import jobs where the createdById of the Import record differs from the owner of the referenced attachment.
Correlate access logs to flag users enumerating sequential or guessed attachmentId values against /api/v1/Import routes.
Monitor API request patterns that combine Import creation with error export calls within a short time window.

Monitoring Recommendations

Centralize EspoCRM web and API logs in a SIEM and alert on anomalous Import activity by low-privilege accounts.
Baseline normal Import volume per user and alert on deviations such as high-frequency Import record creation.
Review user permission assignments regularly and alert when Import scope is granted outside expected administrative groups.

How to Mitigate CVE-2026-109957

Immediate Actions Required

Upgrade EspoCRM to version 10.0.7 or later across all production and staging environments.
Inventory accounts that currently hold Import scope access and revoke the permission where not strictly required.
Review attachment and Import audit history for the past 90 days to identify suspicious cross-user access.

Patch Information

The vendor has released EspoCRM 10.0.7, which adds ownership validation for the attachmentId parameter in the Import endpoint. Apply the official upgrade as documented in the GitHub Security Advisory GHSA-5729-xq64-4h22. Verify the upgraded version through the EspoCRM administration panel after deployment.

Workarounds

Restrict the Import scope role to trusted administrators until the patch can be applied.
Place the EspoCRM API behind a reverse proxy or WAF rule that blocks Import requests from non-administrative user groups.
Disable or hide the error export endpoint for low-privilege roles if operational workflows allow.

bash

# Verify installed EspoCRM version and plan upgrade to 10.0.7
curl -s https://your-espocrm.example.com/api/v1/App/user \
  -H "X-Api-Key: $ADMIN_API_KEY" | jq '.appParams.version'

# After upgrade, confirm the fixed version is deployed
curl -s https://your-espocrm.example.com/api/v1/App/user \
  -H "X-Api-Key: $ADMIN_API_KEY" | jq '.appParams.version'
# Expected output: "10.0.7" or later