EspoCRM CVE-2026-46694

Exploitation requires an authenticated EspoCRM portal user account that already has stream access to the relevant parent record, and the attacker must know (or guess) the specific internal Note's identifier. The flaw is confined to the portal Note API's direct single-Note read path, where the access check does not enforce the isInternal restriction; the stream list endpoint correctly hides internal notes and is not affected. Limiting factors: a valid portal credential is needed, the targeted note must have isInternal=true and belong to a record the user can reach via the stream, and the note ID must be known - there is no bulk enumeration described, so exposure is per-known-identifier rather than wholesale dumping. Versions prior to 9.3.7 are affected; 9.3.7 remediates it.

This is a moderate-severity information-disclosure flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) whose real-world risk is tempered by meaningful preconditions. The vector is network-reachable with low complexity and no user interaction, but PR:L confirms an authenticated portal account is required, so this is not a mass-exploitable unauthenticated bug. Publicly available exploit code exists (GitHub Security Advisory GHSA-cg9f-34hj-p238 plus the fixing commit), which lowers the barrier to weaponization, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active exploitation - treat POC availability and active exploitation as distinct signals. No SSVC decision data was supplied. Impact is confidentiality-only (C:H, I:N, A:N): the attacker reads internal stream notes they should not see but cannot modify or deny service. Net assessment: a credible priority for EspoCRM operators who expose customer/partner portals, but a targeted, access-limited disclosure issue rather than a widespread remote-takeover emergency; patch prioritization should weigh how sensitive internal agent notes are in the given deployment.

An attacker holding a legitimate portal account with stream access to a parent record (e.g., a customer portal login) calls the portal Note API directly to fetch a specific Note by its known identifier. Because the single-Note access check fails to honor the isInternal flag, the response returns internal agent-only content that is normally hidden from stream list responses. Public exploit material exists in the vendor's GitHub Security Advisory and fixing commit, making the required request straightforward to reproduce.