Is CVE-2026-75505 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75505 being exploited in the wild.

How severe is CVE-2026-75505?

Informational severity, published 15 October 2026.

Is there a fix for CVE-2026-75505?

Yes: fixed in 10.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75505 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-75505?

Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75505: EspoCRM mass-update attachment access control bypass

CVE-2026-75505 · Severity: info · Published 2026-10-15

EspoCRM is an open-source customer relationship management system that manages business contacts and interactions. An authenticated user with mass-update permissions can copy attachments from any record by knowing the attachment identifier, bypassing access controls and exposing confidential file contents. While obtaining the identifier requires knowledge of internal IDs, a malicious employee with update rights could extract sensitive documents they are not authorized to view.

Technologies: Espocrm. Vendors: Espocrm.

Quick answers

Is CVE-2026-75505 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75505 being exploited in the wild.
How severe is CVE-2026-75505?: Informational severity, published 15 October 2026.
Which products and versions are affected?: Espocrm prior to 10.0.2.
Is there a fix for CVE-2026-75505?: Yes: fixed in 10.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75505 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-75505?: Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 10.0.2

Technical details

The mass-update processor fails to validate whether the user has read access to an attachment before duplicating it, allowing authenticated users with mass-update permission to copy attachments and bypass record-level and field-level access restrictions. The vulnerability requires knowledge of a valid attachment identifier and valid mass-update privileges. A fix is available in version 10.0.2.

Affected products

EspoCRM EspoCRM prior to 10.0.2

Timeline

2026-10-15: disclosed
2026-07-10: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.