EspoCRM CVE-2026-46708

Requires a valid authenticated EspoCRM account that is low-privileged but has been granted access to a shared TargetList; the attacker then invokes opt-out or cancel-opt-out on Contact/Lead records they cannot read or edit. Limiting factors: exploitation needs an existing authenticated low-privileged account (PR:L) and TargetList access, and the impact is confined to changing the opted_out relationship state of targeted records - there is no confidentiality disclosure and no availability impact. Applies to EspoCRM deployments prior to version 9.3.7.

This is a genuine-but-low-severity authorization flaw (CWE-639, IDOR), and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3 MEDIUM) describes a network-reachable, low-complexity action that requires an existing low-privileged authenticated account and yields only a limited integrity impact (C:N, A:N). Publicly available exploit code exists (vendor GitHub Security Advisory GHSA-mqp6-23xq-7q3r plus the fixing commit, which together disclose the exact code path), but there is NO CISA KEV listing and NO EPSS score in the provided data, so the probability of widespread automated exploitation cannot be quantified from these inputs. The practical impact is narrow: an attacker can only flip the opted_out relationship state of Contact/Lead records they otherwise cannot read or edit - there is no data disclosure and no code execution. Net assessment: a real, confirmed authorization bug worth patching on a normal cycle, but not an emergency; it is a classic high-detail / low-blast-radius issue rather than a high-CVSS-but-overstated finding. Missing EPSS/KEV data means exploitation likelihood is inferred only from POC availability, not confirmed telemetry.

A low-privileged but legitimately authenticated EspoCRM user who has been granted access to a shared TargetList sends opt-out or cancel-opt-out requests referencing Contact or Lead IDs they are not authorized to read or edit. Because the service validated access to the target list but fetched the target record without record-level authorization, the attacker silently toggles those records' marketing opt-out state. A public exploit path is available via the vendor advisory and the fixing commit diff.