# CVE-2026-113643: EspoCRM authorization bypass in PDF image rendering

Source: https://junglewise.ai/threats/cve-2026-113643-a-vulnerability-was-found-in-espocrm-up-to-9-3-10-10-0-10-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113643 · Severity: medium · CVSS 4.3 · Published 2026-10-20

EspoCRM is an open-source customer relationship management (CRM) platform used to manage business contacts and sales workflows. A vulnerability in its PDF rendering component allows attackers to bypass authorization checks by manipulating image ID parameters, potentially exposing sensitive data embedded in generated PDFs. The attack can be performed remotely without user interaction.

Technologies: [Espocrm](https://junglewise.ai/threats/technologies/espocrm). Vendors: [Espocrm](https://junglewise.ai/threats/vendors/espocrm).

## Quick answers

**Is CVE-2026-113643 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113643 being exploited in the wild.

**How severe is CVE-2026-113643?** Medium severity, with a CVSS score of 4.3, published 20 October 2026.

**Which products and versions are affected?** Espocrm up to 9.3.10 and 10.0.10.

**Is there a fix for CVE-2026-113643?** Yes: fixed in Versions after 9.3.10 and 10.0.10 (patch 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113643 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-113643?** Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Versions after 9.3.10 and 10.0.10 (patch 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2)

## Technical details

An authorization bypass vulnerability exists in the ImageSourceProvider::get method within the PDF rendering pipeline component. The vulnerability stems from insufficient validation of image ID parameters, allowing attackers to access unauthorized images by manipulating the ID argument. This is a network-based attack requiring no authentication or special privileges.

## Affected products

- EspoCRM EspoCRM up to 9.3.10 and 10.0.10

## Timeline

- 2026-10-20: disclosed
- 2026-09-28: patched

## References

- [https://github.com/espocrm/espocrm/](https://github.com/espocrm/espocrm/)
- [https://github.com/espocrm/espocrm/commit/91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2](https://github.com/espocrm/espocrm/commit/91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2)

## Related threats

- [EspoCRM denial of service in password-redaction regex](https://junglewise.ai/threats/cve-2026-118686-espocrm-before-9-3-11-and-10-x-before-10-0-8-contains-a-denial)
- [EspoCRM mass-update attachment access control bypass](https://junglewise.ai/threats/cve-2026-75505-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM HTML injection in email notifications](https://junglewise.ai/threats/cve-2026-59994-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM CSV/XLSX formula injection via whitespace bypass](https://junglewise.ai/threats/cve-2026-55154-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM unsafe deserialization in MassAction and Export](https://junglewise.ai/threats/cve-2026-47168-espocrm-is-an-open-source-customer-relationship-management)