Groundhogg CRM EUVD-2026-53177

Exploitation requires an authenticated WordPress session with the view_contacts capability. The primary at-risk role is Groundhogg's built-in Sales Rep role, which is explicitly designed to restrict visibility to owned contacts - a user holding this role can exploit the flaw to read all contacts site-wide. Any other custom role granted view_contacts without view_others_contacts is equally vulnerable. The flaw does not affect sites where all authenticated users already hold view_others_contacts (i.e., where no access segregation between contacts is enforced). Exploitation is limited to: (1) possession of a valid WordPress user account with view_contacts, (2) network access to the WordPress REST API endpoint, and (3) knowledge of sequential integer contact IDs (trivially enumerable from 1 upward). There is no UI interaction required, no special network position needed beyond normal HTTPS access to the site, and no non-default configuration prerequisite other than having at least one Sales Rep or equivalent role provisioned.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium), which reasonably represents the risk: low-privilege network exploitation with high confidentiality impact. The attack complexity is genuinely low - sequential integer contact IDs require no guessing or brute-force beyond simple enumeration, and the Sales Rep role is a designed, documented role that organizations actively provision for legitimate staff. No EPSS score was provided in the source data, and this CVE has not appeared in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The 'Authentication Bypass' tag in the intelligence data is somewhat misleading: this is an authorization bypass (the attacker is authenticated but bypasses object-level access control), not a full authentication bypass - defenders should not conflate the two. The real-world risk is highest in organizations using Groundhogg in a multi-tenant or sales-team configuration where the Sales Rep role has been provisioned to staff who should have siloed visibility. The exposure of linked WordPress user capability sets is a meaningful secondary risk, as it could inform privilege escalation targeting. No POC exploit code was referenced; however, the vulnerability is trivially reproducible from the description alone.

An attacker with a provisioned Sales Rep account (or any account granted view_contacts) authenticates to the WordPress site and issues sequential GET requests to /wp-json/gh/v4/contacts/1, /wp-json/gh/v4/contacts/2, and so on using standard HTTP tooling. Each successful response returns the full contact record - name, email, phone, custom meta fields, the assigned owner's user ID, and for contacts linked to WordPress accounts, the full wp_capabilities array revealing their role and permissions. No public exploit code is currently identified, but the attack requires no special tooling beyond a valid session cookie and an HTTP client.