CVE-2026-41160

EspoCRM is an open source customer relationship management application. Prior to 9.3.5, a business logic flaw (Broken Access Control) in EspoCRM 9.3.3 allows low-privileged users to pin arbitrary notes without having the required edit permissions for the parent object. Due to a "write first, authorize later" execution flaw in the backend API, even though the server correctly returns a 403 Forbidden error, the targeted note's pinned status is already persistently modified in the database. The root cause lies in the server-side processing of the POST /api/v1/Note/{id}/pin endpoint. In application/Espo/Tools/Stream/Api/PostNotePin.php, the process() method first calls getNote($id) before calling checkParent($note). This vulnerability is fixed in 9.3.5.

• CWE-284
• CWE-639
• CWE-862

• https://github.com/espocrm/espocrm/security/advisories/GHSA-c3rm-m24p-255p
• https://github.com/espocrm/espocrm/security/advisories/GHSA-c3rm-m24p-255p

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41155An attacker could cooperatively pass data from one secure GP…5.5
• CVE-2026-41156Software installed and run as a non-privileged user may cond…7.7
• CVE-2026-41157A web page that contains unusual WebGPU content loaded into …9.8
• CVE-2026-41158Software installed and run as a non-privileged user may cond…7.8
• CVE-2026-41159Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3
• CVE-2026-4116Improper handling of Unicode encoding in SonicWall SMA1000 s…7.2
• CVE-2026-41161Sync-in Server is a secure, open-source platform for file st…5.3
• CVE-2026-41163bubblewrap is a low-level unprivileged sandboxing tool. From…8.7
• CVE-2026-41164nuts-node is the reference implementation of the Nuts specif…4.4
• CVE-2026-41166OpenRemote is an open-source internet-of-things platform. Pr…7
• CVE-2026-41167Jellystat is a free and open source Statistics App for Jelly…9.1
• CVE-2026-41168pypdf is a free and open-source pure-python PDF library. An …5.3