Executive brief
EspoCRM is an open-source platform used by businesses to manage customer relationships, sales, and support tickets. A security flaw in the application allows low-privileged users to 'pin' notes to records even when they do not have permission to edit those records. This could allow unauthorized users to manipulate the visibility and priority of information within the system, potentially disrupting business workflows or misleading staff members.
Technical details
A broken access control vulnerability exists in EspoCRM due to a 'write first, authorize later' execution flow in the Note Pinning API. Specifically, in the `POST /api/v1/Note/{id}/pin` endpoint, the `process()` method in `PostNotePin.php` retrieves and saves the pinned status of a note before performing the `checkParent()` authorization check. While the server eventually returns a 403 Forbidden error to the user, the database state is persistently modified before the error is triggered. An authenticated attacker with low privileges can exploit this to bypass UI restrictions and modify the pinned status of notes they do not own. This issue is resolved in version 9.3.5.
Affected products
- EspoCRM EspoCRM 9.3.3, 9.3.4, and all versions prior to 9.3.5
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-05-28: disclosed: NVD publication date