EspoCRM CVE-2026-33740

Exploitation requires an authenticated EspoCRM account with both Email:create and Import permissions explicitly granted by an administrator - these are non-default role permissions. The attacker must also possess a valid attachment ID belonging to another user; however, such IDs are commonly disclosed in normal application use via stream API payloads and attachment download links, substantially lowering the enumeration barrier. Exploitation is confined to the POST /api/v1/Email/importEml endpoint; the standard attachment download path already enforces ACL checks and is not affected. Unauthenticated actors cannot exploit this vulnerability. Users without the Email:create and Import permission combination are similarly excluded from the attack surface.

The CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) correctly models this as network-reachable, low-complexity, and requiring authenticated low-privilege access. The integrity impact (I:L) deserves specific attention: the victim's original attachment record is permanently deleted as a side effect of the import flow, which may be treated as more impactful than the C:L confidentiality score alone implies in environments relying on email evidence retention. EPSS at 0.02% (5th percentile) and SSVC's 'Automatable: no' designation together indicate very low scanning or opportunistic exploitation pressure at time of analysis. The vulnerability is not in CISA KEV, meaning no confirmed active exploitation in production environments. However, a public PoC exists via the vendor advisory, and practical exploitability is elevated because attachment IDs are routinely exposed through stream API payloads and download links during normal EspoCRM use - reducing attacker reconnaissance burden significantly. The most realistic risk scenario is an insider threat or a compromised low-privilege account in a multi-tenant deployment where sensitive business communications are stored as email attachments.

An attacker with a low-privilege EspoCRM account (Email:create and Import permissions assigned) observes a colleague's attachment ID in a shared email thread's stream API payload or intercepts it from a download link. The attacker crafts a POST to /api/v1/Email/importEml supplying the victim's fileId, bypassing ACL validation, and retrieves the victim's .eml attachment contents imported into their own mailbox - while the victim's original attachment record is permanently deleted. A public proof-of-concept is referenced in the vendor advisory at GHSA-wr7j-hxf8-hc4w.