CVE-2026-46708

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the target list but retrieves the target record without the required record authorization, allowing unauthorized changes to its opted_out relationship state. This issue is fixed in version 9.3.7.

• CWE-639
• CWE-862

• https://github.com/espocrm/espocrm/commit/5be59190cb683d8ac50a76e96a01aa6f51b4973a
• https://github.com/espocrm/espocrm/releases/tag/9.3.7
• https://github.com/espocrm/espocrm/security/advisories/GHSA-mqp6-23xq-7q3r

Published

Oct 15, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4670Authentication bypass by primary weakness vulnerability in P…9.8
• CVE-2026-46700Actual is a local-first personal finance tool. Prior to 26.6…4.3
• CVE-2026-46701Network-AI is a TypeScript/Node.js multi-agent orchestrator.…7.6
• CVE-2026-46702Russh is a Rust SSH client & server library. From version 0.…7.5
• CVE-2026-46703Boxlite is a sandbox service that allows users to create lig…9.6
• CVE-2026-46705Russh is a Rust SSH client & server library. From version 0.…5.3
• CVE-2026-46709Tabby (formerly Terminus) is a highly configurable terminal …7.8
• CVE-2026-4671justhtml before 1.18.0 contains multiple low-severity denial…7.5
• CVE-2026-46710Notepad++ is a free and open-source source code editor. From…7.8
• CVE-2026-46711Soft Machine is a Virtual Machine–based agentic development …8.3
• CVE-2026-46712Misskey is an open source, federated social media platform. …2.3
• CVE-2026-46713Misskey is an open source, federated social media platform. …9.2