PT-2026-32522 · Espocrm · Espocrm

Yurikuzn · Published 2026-04-13 · Updated 2026-04-14 · CVE-2026-33740

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.4

Description An Insecure Direct Object Reference (IDOR) exists in the '/api/v1/Email/importEml' endpoint. The fileId parameter is used to fetch attachments from the repository without verifying if the current user is authorized to access them. Authenticated users with Email:create and Import permissions can read other users' .eml attachment contents by importing them into their own mailbox, which also results in the deletion of the original attachment record.

Recommendations Update to version 9.3.4. As a temporary workaround, restrict access to the '/api/v1/Email/importEml' endpoint.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-33740

Affected Products

Espocrm

References · 6

• 🔥 https://github.com/espocrm/espocrm/releases/tag/9.3.4 · Exploit
• 🔥 https://github.com/espocrm/espocrm/commit/88e3ba6a7b5cab5dbc2298e2a093d3aa383aa95f · Exploit
• 🔥 https://github.com/espocrm/espocrm/security/advisories/GHSA-wr7j-hxf8-hc4w · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33740 · Security Note
• https://twitter.com/CVEnew/status/2043976201547428170 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043883198002680108 · Twitter Post