What is the CVSS score of CVE-2026-41160?

CVE-2026-41160 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-41160?

Yes, a public proof-of-concept exploit is available for CVE-2026-41160. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-41160?

Yes, a patch is available for CVE-2026-41160. Update the affected software to the latest version immediately.

EspoCRM CVE-2026-41160

EUVD-2026-32946 MEDIUM

Improper Access Control (CWE-284)

2026-05-28 GitHub_M

PHP Authentication Bypass

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 28, 2026 - 18:02 EUVD

Analysis Generated

May 28, 2026 - 17:27 vuln.today

DescriptionGitHub Advisory

EspoCRM is an open source customer relationship management application. Prior to 9.3.5, a business logic flaw (Broken Access Control) in EspoCRM 9.3.3 allows low-privileged users to pin arbitrary notes without having the required edit permissions for the parent object. Due to a "write first, authorize later" execution flaw in the backend API, even though the server correctly returns a 403 Forbidden error, the targeted note's pinned status is already persistently modified in the database. The root cause lies in the server-side processing of the POST /api/v1/Note/{id}/pin endpoint. In application/Espo/Tools/Stream/Api/PostNotePin.php, the process() method first calls getNote($id) before calling checkParent($note). This vulnerability is fixed in 9.3.5.

AnalysisAI

{id}/pin endpoint, where the server returns a 403 Forbidden response but the targeted record is already persistently modified. A publicly available exploit exists; this vulnerability is not confirmed actively exploited per CISA KEV, and impact is constrained to unauthorized data integrity modification without confidentiality or availability consequences.

Technical ContextAI

EspoCRM is a PHP-based open source CRM platform. The vulnerability originates in application/Espo/Tools/Stream/Api/PostNotePin.php, where the process() method invokes getNote($id) to fetch and modify the record's pin state before calling checkParent($note) to validate the requesting user's permissions - a classic 'write first, authorize later' execution order inversion. CWE-284 (Improper Access Control) classifies this as a broken access control / business logic flaw: the authorization gate is structurally bypassed because the side effect (database write) completes prior to the permission check returning a reject signal. The affected CPE is cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:* covering all EspoCRM releases before 9.3.5. Tags indicate PHP and Authentication Bypass surface area.

RemediationAI

Upgrade to EspoCRM 9.3.5, which contains the vendor-confirmed fix for this vulnerability per the GitHub Security Advisory at https://github.com/espocrm/espocrm/security/advisories/GHSA-c3rm-m24p-255p. If immediate patching is not feasible, a compensating control would be to restrict network or WAF-level access to the POST /api/v1/Note/{id}/pin API endpoint, though this will disable note-pinning functionality entirely for all users, including those with legitimate permissions - assess operational impact before applying. Additionally, auditing the database for unexpected or unauthorized note pin state changes can help detect exploitation in the interim. Minimizing the number of low-privileged user accounts with API access reduces the attack surface until the patch is applied.