{"id":"CVE-2026-113643","title":"EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization","summary":"A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a man…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-639","CWE-285"],"product":"EspoCRM","affected":["EspoCRM 9.3.0","EspoCRM 9.3.1","EspoCRM 9.3.2","EspoCRM 9.3.3","EspoCRM 9.3.4","EspoCRM 9.3.5","EspoCRM 9.3.6","EspoCRM 9.3.7","EspoCRM 9.3.8","EspoCRM 9.3.9","EspoCRM 9.3.10","EspoCRM 10.0.0","EspoCRM 10.0.1","EspoCRM 10.0.2","EspoCRM 10.0.3","EspoCRM 10.0.4","EspoCRM 10.0.5","EspoCRM 10.0.6","EspoCRM 10.0.7","EspoCRM 10.0.8","EspoCRM 10.0.9","EspoCRM 10.0.10"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T18:44:37.586697Z"},"exploitAvailable":true,"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T18:45:14.681Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113643","references":[{"url":"https://vuldb.com/vuln/422794","label":"VDB-422794 | EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization"},{"url":"https://vuldb.com/vuln/422794/cti","label":"VDB-422794 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-113643","label":"CVE-2026-113643 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1010801","label":"Submit #1010801 | EspoCRM 10.0.9 Improper Access Control"},{"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-r277-qh74-r86f"},{"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-w46f-mj7x-v5c6"},{"url":"https://github.com/espocrm/espocrm/commit/91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2"},{"url":"https://github.com/espocrm/espocrm/"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-10-20T19:16:14.386Z","slug":"CVE-2026-113643","body":"## Overview\n\nA vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.\n\n## Affected\n\n- `EspoCRM 9.3.0`\n- `EspoCRM 9.3.1`\n- `EspoCRM 9.3.2`\n- `EspoCRM 9.3.3`\n- `EspoCRM 9.3.4`\n- `EspoCRM 9.3.5`\n- `EspoCRM 9.3.6`\n- `EspoCRM 9.3.7`\n- `EspoCRM 9.3.8`\n- `EspoCRM 9.3.9`\n- `EspoCRM 9.3.10`\n- `EspoCRM 10.0.0`\n- `EspoCRM 10.0.1`\n- `EspoCRM 10.0.2`\n- `EspoCRM 10.0.3`\n- `EspoCRM 10.0.4`\n- `EspoCRM 10.0.5`\n- `EspoCRM 10.0.6`\n- `EspoCRM 10.0.7`\n- `EspoCRM 10.0.8`\n- `EspoCRM 10.0.9`\n- `EspoCRM 10.0.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}