CVE-2026-46708
mediumEspoCRM is an open source customer relationship management application.
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the target list but retrieves the target record without the required record authorization, allowing unauthorized changes to its opted_out relationship state. This issue is fixed in version 9.3.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/espocrm/espocrm/commit/5be59190cb683d8ac50a76e96a01aa6f51b4973a security-advisories@github.com
- https://github.com/espocrm/espocrm/releases/tag/9.3.7 security-advisories@github.com
- https://github.com/espocrm/espocrm/security/advisories/GHSA-mqp6-23xq-7q3r security-advisories@github.com