# CVE-2026-75505: EspoCRM mass-update attachment access control bypass

Source: https://junglewise.ai/threats/cve-2026-75505-espocrm-is-an-open-source-customer-relationship-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-75505 · Severity: info · Published 2026-10-15

EspoCRM is an open-source customer relationship management system that manages business contacts and interactions. An authenticated user with mass-update permissions can copy attachments from any record by knowing the attachment identifier, bypassing access controls and exposing confidential file contents. While obtaining the identifier requires knowledge of internal IDs, a malicious employee with update rights could extract sensitive documents they are not authorized to view.

Technologies: [Espocrm](https://junglewise.ai/threats/technologies/espocrm). Vendors: [Espocrm](https://junglewise.ai/threats/vendors/espocrm).

## Quick answers

**Is CVE-2026-75505 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75505 being exploited in the wild.

**How severe is CVE-2026-75505?** Informational severity, published 15 October 2026.

**Which products and versions are affected?** Espocrm prior to 10.0.2.

**Is there a fix for CVE-2026-75505?** Yes: fixed in 10.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75505 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75505?** Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.0.2

## Technical details

The mass-update processor fails to validate whether the user has read access to an attachment before duplicating it, allowing authenticated users with mass-update permission to copy attachments and bypass record-level and field-level access restrictions. The vulnerability requires knowledge of a valid attachment identifier and valid mass-update privileges. A fix is available in version 10.0.2.

## Affected products

- EspoCRM EspoCRM prior to 10.0.2

## Timeline

- 2026-10-15: disclosed
- 2026-07-10: patched

## References

- [https://github.com/espocrm/espocrm/commit/5be3e7ef2a010c151551a8bc277e9ca61e1503d4](https://github.com/espocrm/espocrm/commit/5be3e7ef2a010c151551a8bc277e9ca61e1503d4)
- [https://github.com/espocrm/espocrm/releases/tag/10.0.2](https://github.com/espocrm/espocrm/releases/tag/10.0.2)

## Related threats

- [EspoCRM denial of service in password-redaction regex](https://junglewise.ai/threats/cve-2026-118686-espocrm-before-9-3-11-and-10-x-before-10-0-8-contains-a-denial)
- [EspoCRM authorization bypass in PDF image rendering](https://junglewise.ai/threats/cve-2026-113643-a-vulnerability-was-found-in-espocrm-up-to-9-3-10-10-0-10-this)
- [EspoCRM HTML injection in email notifications](https://junglewise.ai/threats/cve-2026-59994-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM CSV/XLSX formula injection via whitespace bypass](https://junglewise.ai/threats/cve-2026-55154-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM unsafe deserialization in MassAction and Export](https://junglewise.ai/threats/cve-2026-47168-espocrm-is-an-open-source-customer-relationship-management)