Description
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachment ID, then call the error export endpoint to copy source rows into a downloadable CSV they own.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| espocrm | espocrm | < 10.0.7 | 10.0.7 |
References
- GitHub Security Advisory (GHSA-5729-xq64-4h22) vendor-advisory
- VulnCheck Advisory: EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter third-party-advisory