{"id":"CVE-2026-75505","title":"EspoCRM is an open source customer relationship management application","summary":"EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update process…","severity":"medium","cvss":6,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-862"],"vendor":"espocrm","product":"espocrm","affected":["espocrm < 10.0.2"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T16:18:20.220","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75505","references":[{"url":"https://github.com/espocrm/espocrm/commit/5be3e7ef2a010c151551a8bc277e9ca61e1503d4","label":"security-advisories@github.com"},{"url":"https://github.com/espocrm/espocrm/releases/tag/10.0.2","label":"security-advisories@github.com"},{"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-24pg-2q7q-m5p6","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"cvssSource":"cna","ingestedAt":"2026-10-15T16:13:11.761Z","slug":"CVE-2026-75505","body":"## Overview\n\nEspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the caller can read it, bypassing record-level and field-level restrictions and exposing the file contents through the copied attachment. Obtaining a valid attachment identifier may be difficult. This issue is fixed in version 10.0.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":33,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}