---
id: CVE-2026-46708
title: EspoCRM is an open source customer relationship management application
summary: >-
  EspoCRM is an open source customer relationship management application. Prior
  to 9.3.7, a low-privileged user who can access a shared TargetList can invoke
  opt-out or cancel-opt-out actions for a protected Contact or Lead that the
  user c…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-639
  - CWE-862
vendor: espocrm
product: espocrm
affected:
  - espocrm < 9.3.7
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:18:12.220'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46708'
references:
  - url: >-
      https://github.com/espocrm/espocrm/commit/5be59190cb683d8ac50a76e96a01aa6f51b4973a
    label: security-advisories@github.com
  - url: 'https://github.com/espocrm/espocrm/releases/tag/9.3.7'
    label: security-advisories@github.com
  - url: 'https://github.com/espocrm/espocrm/security/advisories/GHSA-mqp6-23xq-7q3r'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T15:46:40.050117Z'
ingestedAt: '2026-10-15T15:09:08.433Z'
---

## Overview

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the target list but retrieves the target record without the required record authorization, allowing unauthorized changes to its opted_out relationship state. This issue is fixed in version 9.3.7.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.