CVE-2026-46691

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that import. The endpoint performs a scope-level check but omits the entity-level ownership check enforced by the Import AccessChecker and sibling Import endpoints. This issue is fixed in version 9.3.7.

• CWE-862

• https://github.com/espocrm/espocrm/commit/71ad7661215d25f7d0f2756c8e8dbc257cad848f
• https://github.com/espocrm/espocrm/releases/tag/9.3.7
• https://github.com/espocrm/espocrm/security/advisories/GHSA-rrcj-rhc2-ch5q

Published

Oct 15, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46685RustFS is a distributed object storage system built in Rust.…6
• CVE-2026-46686Emlog is an open source website building system. In 2.6.13 a…8.5
• CVE-2026-46687Emlog is an open source website building system. In 2.6.13 a…7.7
• CVE-2026-46688The Meeting Room Booking System (MRBS) is a PHP-based applic…6.9
• CVE-2026-46689Kanidm is an identity management platform. Prior to version …8.7
• CVE-2026-46690unbounded_spsc is an "unbounded" extension of bounded_spsc_q…5.8
• CVE-2026-46692ImageMagick is free and open-source software used for editin…4.1
• CVE-2026-46693ImageMagick is free and open-source software used for editin…4.1
• CVE-2026-46694EspoCRM is an open source customer relationship management a…6.5
• CVE-2026-46695Boxlite is a sandbox service that allows users to create lig…10
• CVE-2026-46696October System provides the system module for October Conten…3.3
• CVE-2026-46697Fediverse Embeds embeds fediverse posts on WordPress sites. …7.5