# CVE-2026-41160: EspoCRM broken access control in Note Pinning API

Source: https://junglewise.ai/threats/cve-2026-41160-espocrm-broken-access-control-in-note-pinning-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-41160 · Severity: medium · CVSS 4.3 · Published 2026-05-28

EspoCRM is an open-source platform used by businesses to manage customer relationships, sales, and support tickets. A security flaw in the application allows low-privileged users to 'pin' notes to records even when they do not have permission to edit those records. This could allow unauthorized users to manipulate the visibility and priority of information within the system, potentially disrupting business workflows or misleading staff members.

Technologies: [Espocrm](https://junglewise.ai/threats/technologies/espocrm). Vendors: [Espocrm](https://junglewise.ai/threats/vendors/espocrm).

## Quick answers

**Is CVE-2026-41160 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41160 being exploited in the wild.

**How severe is CVE-2026-41160?** Medium severity, with a CVSS score of 4.3, published 28 May 2026.

**Which products and versions are affected?** Espocrm 9.3.3, 9.3.4, and all versions prior to 9.3.5.

**Is there a fix for CVE-2026-41160?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41160 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41160?** Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in EspoCRM due to a 'write first, authorize later' execution flow in the Note Pinning API. Specifically, in the `POST /api/v1/Note/{id}/pin` endpoint, the `process()` method in `PostNotePin.php` retrieves and saves the pinned status of a note before performing the `checkParent()` authorization check. While the server eventually returns a 403 Forbidden error to the user, the database state is persistently modified before the error is triggered. An authenticated attacker with low privileges can exploit this to bypass UI restrictions and modify the pinned status of notes they do not own. This issue is resolved in version 9.3.5.

## Affected products

- EspoCRM EspoCRM 9.3.3, 9.3.4, and all versions prior to 9.3.5

## Timeline

- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-05-28: disclosed: NVD publication date

## References

- [https://github.com/espocrm/espocrm/security/advisories/GHSA-c3rm-m24p-255p](https://github.com/espocrm/espocrm/security/advisories/GHSA-c3rm-m24p-255p)

## Related threats

- [EspoCRM denial of service in password-redaction regex](https://junglewise.ai/threats/cve-2026-118686-espocrm-before-9-3-11-and-10-x-before-10-0-8-contains-a-denial)
- [EspoCRM authorization bypass in PDF image rendering](https://junglewise.ai/threats/cve-2026-113643-a-vulnerability-was-found-in-espocrm-up-to-9-3-10-10-0-10-this)
- [EspoCRM mass-update attachment access control bypass](https://junglewise.ai/threats/cve-2026-75505-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM HTML injection in email notifications](https://junglewise.ai/threats/cve-2026-59994-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM CSV/XLSX formula injection via whitespace bypass](https://junglewise.ai/threats/cve-2026-55154-espocrm-is-an-open-source-customer-relationship-management)