CVE-2026-53574

high

EspoCRM is an open source customer relationship management application.

EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.

CVSS

7.6

7.6 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Severity source: NVD CVSS v3.1 (security-advisories@github.com)

Timeline (UTC)

Published: 2026-10-15 15:17

Modified: 2026-10-15 16:18

NVD status: Deferred

Last synced 1 day ago

Verified against the source API 2026-10-27 07:03 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-89

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://github.com/espocrm/espocrm/commit/e4a6aea90886d672f96b5d9a7cb0722e3d3654e1 security-advisories@github.com
https://github.com/espocrm/espocrm/releases/tag/9.3.8 security-advisories@github.com
https://github.com/espocrm/espocrm/security/advisories/GHSA-qgm7-fc9g-fj75 security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:03 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores