EspoCRM CVE-2026-53574

Requires an authenticated session as a non-administrator user (PR:L) on an EspoCRM instance running a version from 8.1.0 up to but not including 9.3.8. The specific vulnerable surface is the GET entity streamAttachments endpoint, whose query path permitted complex expressions in the 'where' parameter (the fix adds withComplexExpressionsForbidden() and rejects the '#' character in attributes). No special non-default configuration is needed and no user interaction is required, but the low-privilege authentication requirement is the primary limiting factor: fully anonymous exploitation is not possible. Risk is highest where low-privilege account registration is open or where many users hold standard accounts.

This is a genuine prioritization candidate rather than a paper-high score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction - i.e. any authenticated non-administrator account suffices, which is a low bar in a multi-user CRM. Publicly available exploit code exists (vendor GitHub Security Advisory GHSA-qgm7-fc9g-fj75 plus the fixing commit), raising practical risk materially above a typical PR:L SQLi because the boolean-based blind technique is well understood and the advisory path is public. The technical impact is amplified beyond the C:H/I:L/A:L base: the description states the injection can extract active administrator session tokens, which converts a low-privilege read primitive into effective full administrative takeover (privilege escalation). No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted. The CVE is NOT listed in CISA KEV and no active in-the-wild exploitation is claimed - so despite public POC this should be treated as exploitable-and-likely-to-be-targeted rather than confirmed mass-exploited. Net: medium-footprint product, real and public exploit path, authenticated-but-low barrier, admin-takeover consequence - worth prompt patching for any internet-exposed EspoCRM instance.

An attacker holding (or registering/phishing) any low-privilege EspoCRM user account sends a crafted 'where' parameter to the GET entity streamAttachments endpoint, which permits complex expressions and passes attacker input into the SQL query. Using boolean-based blind SQL injection they iteratively extract database contents - notably an active administrator's session token - then reuse that token to authenticate as administrator and take over the instance. Publicly available exploit material (vendor advisory and fixing commit) lowers the effort required.