EspoCRM EUVD-2026-98661

Exploitation requires an authenticated EspoCRM account that has been granted Import scope access (reflected in CVSS PR:L); anonymous or Import-less users cannot trigger it. The attacker must also know or guess a valid foreign attachmentId, and the specific abuse path chains the Import record creation with the error-export endpoint to exfiltrate the referenced rows as a CSV. Limiting factors that reduce realistic risk: the Import permission is an administrative role grant not held by all users, impact is confined to reading other users' attachments (confidentiality only, no modification or service disruption), and the deployment must be running a version before 10.0.7.

This is a medium-severity authorization flaw (CVSS 4.0 base 5.3) whose signals are internally consistent and point to a bounded, not critical, risk. The CVSS vector AV:N/AC:L/AT:N/PR:L/UI:N establishes network-reachable, low-complexity exploitation but requires an authenticated account (PR:L) that specifically holds Import scope access - a meaningful gate that limits the attacker population to existing authorized users rather than anonymous internet attackers. Impact is confidentiality-only and rated Low (VC:L, VI:N, VA:N): an attacker reads other users' attachments but gains no write/integrity or availability impact. A public exploit exists (vendor GHSA advisory with PoC from EspoCRM/VulnCheck), which raises practical exploitability for anyone with a foothold, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of widespread or automated real-world exploitation. Net: a real, confirmed, PoC-backed data-exposure bug worth patching promptly in multi-tenant/multi-user EspoCRM deployments, but the PR:L requirement and confidentiality-only, Low-magnitude impact keep it below top-priority 'drop everything' status. No signals conflict; the main missing signals are EPSS probability and any active-exploitation telemetry.

An authenticated EspoCRM user who has been granted Import scope access creates an Import record that references another user's known or guessed attachmentId, then invokes the error-export endpoint to copy the referenced source rows into a CSV that the attacker owns and can download. A public proof-of-concept exists (vendor GHSA advisory), and because the CVSS vector is AV:N/AC:L, the action requires only normal network access and no special timing or user interaction beyond the attacker's own authenticated session.