What is the CVSS score of CVE-2026-41160?

CVE-2026-41160 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-41160?

Yes, a public proof-of-concept exploit is available for CVE-2026-41160. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-41160?

Yes, a patch is available for CVE-2026-41160. Update the affected software to the latest version immediately.

PHP CVE-2026-41160

EUVD-2026-32946 MEDIUM

Improper Access Control (CWE-284)

2026-05-28 GitHub_M

Authentication Bypass PHP Espocrm

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 28, 2026 - 18:02 EUVD

Analysis Generated

May 28, 2026 - 17:27 vuln.today

CVE Published

May 28, 2026 - 16:24 github-advisory

MEDIUM 4.3

DescriptionGitHub Advisory

EspoCRM is an open source customer relationship management application. Prior to 9.3.5, a business logic flaw (Broken Access Control) in EspoCRM 9.3.3 allows low-privileged users to pin arbitrary notes without having the required edit permissions for the parent object. Due to a "write first, authorize later" execution flaw in the backend API, even though the server correctly returns a 403 Forbidden error, the targeted note's pinned status is already persistently modified in the database. The root cause lies in the server-side processing of the POST /api/v1/Note/{id}/pin endpoint. In application/Espo/Tools/Stream/Api/PostNotePin.php, the process() method first calls getNote($id) before calling checkParent($note). This vulnerability is fixed in 9.3.5.

AnalysisAI

Unauthorized note pinning in EspoCRM 9.3.x allows authenticated low-privileged users to pin arbitrary notes, bypassing edit permissions on the parent object. A 'write first, authorize later' flaw in the POST /api/v1/Note/{id}/pin endpoint silently persists the pinned status even when the server returns a 403 error. Exploit code is publicly available, but the vulnerability has a low EPSS score (0.04%) and has not been observed in active exploitation.