CVE-2026-75505: EspoCRM Authentication Bypass Vulnerability

CVE-2026-75505 Overview

EspoCRM is an open source customer relationship management (CRM) application used by organizations to manage contacts, leads, and business workflows. CVE-2026-75505 affects EspoCRM versions prior to 10.0.2 and stems from a missing authorization check [CWE-862] in the mass-update processor. An authenticated user who holds mass-update permission can supply a known attachment identifier, and the processor duplicates the referenced attachment without verifying read access. The duplicated attachment exposes file contents that record-level and field-level restrictions would otherwise block. EspoCRM resolved the issue in version 10.0.2.

Critical Impact
Authenticated attackers with mass-update rights can read restricted attachment contents by cloning files they are not authorized to view, bypassing record-level and field-level access controls.

Affected Products

EspoCRM versions prior to 10.0.2
EspoCRM mass-update functionality (application/Espo/Tools/MassUpdate/Processor.php)
Deployments that assign mass-update permission to non-administrative roles

Discovery Timeline

2026-10-15 - CVE-2026-75505 published to the National Vulnerability Database
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-75505

Vulnerability Analysis

The flaw lives in the mass-update processor, which allows users to apply field changes across multiple records in a single operation. When a target field references an attachment, the processor duplicates the referenced file so each updated record owns a distinct copy. The duplication path trusts the attachment identifier supplied by the caller and performs no read-authorization check against the source attachment. An authenticated user with mass-update permission can therefore submit the identifier of any attachment stored in the system and receive a copy attached to a record the user already controls. Reading the copied attachment then returns the full contents of the original file, defeating record-level and field-level access controls.

Root Cause

The root cause is a missing authorization check [CWE-862] in the mass-update attachment duplication logic. The processor relies on the caller's permission to perform the mass-update action but does not revalidate that the caller is permitted to read the specific attachment identifier referenced in the request. Authorization for the containing record is not propagated to the attachment copy operation.

Attack Vector

Exploitation requires network access to the EspoCRM instance, valid credentials, and the mass-update privilege. The attacker must also obtain or guess a valid attachment identifier, which the advisory notes may be difficult in practice. Given a valid identifier, the attacker triggers a mass-update that writes the attachment reference into a record they can read, then downloads the duplicated file to retrieve the restricted content.

php

        Data $data,
        int $i,
        array $fieldToCopyList,
-       Service $service
+       Service $service,
    ): bool {

        $service->loadAdditionalFields($entity);

Source: GitHub commit 5be3e7e. The patch modifies the mass-update processor signature and attachment handling in application/Espo/Tools/MassUpdate/Processor.php to enforce proper authorization during attachment duplication.

Detection Methods for CVE-2026-75505

Indicators of Compromise

Mass-update API requests referencing attachment identifiers that the submitting user has no prior history of accessing.
Sudden growth in duplicated attachment records tied to a single user or session.
Download events against attachment records created immediately after a mass-update operation.

Detection Strategies

Review EspoCRM application logs for MassUpdate requests that include attachment field payloads, correlating the attachment ID with the submitter's permission scope.
Alert when the same user submits sequential mass-update requests that each write different attachment identifiers into records they own.
Compare attachment-create events against the originating user's read authorization on the source attachment's parent record.

Monitoring Recommendations

Forward EspoCRM web and audit logs to a centralized log platform and retain mass-update events for post-incident review.
Baseline normal mass-update volume per role, and investigate users exceeding that baseline.
Monitor outbound downloads of newly created attachments by non-administrative accounts.

How to Mitigate CVE-2026-75505

Immediate Actions Required

Upgrade EspoCRM to version 10.0.2 or later, which contains the authorization fix.
Audit roles that grant mass-update permission and remove the privilege where it is not required.
Review recent mass-update activity for suspicious attachment references and investigate any unauthorized duplications.

Patch Information

The fix is included in EspoCRM 10.0.2. The code change is documented in GitHub commit 5be3e7e and the vendor advisory is published as GHSA-24pg-2q7q-m5p6. Administrators should apply the upgrade following the standard EspoCRM upgrade procedure and verify the installed version after deployment.

Workarounds

Restrict the mass-update permission to trusted administrative roles until the upgrade is applied.
Limit network exposure of the EspoCRM instance to authenticated internal users while patching is scheduled.
Rotate or revoke access to sensitive attachments that may have been exposed prior to remediation.

bash

# Verify installed EspoCRM version after upgrade
curl -s https://<espocrm-host>/api/v1/App/user \
  -H "X-Api-Key: <admin-api-key>" | jq '.appParams.version'
# Expected output: "10.0.2" or higher