Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-113643: EspoCRM PDF rendering can be bypassed for unauthorized access

CVE-2026-113643 · published 15 days ago

Summary

EspoCRM versions up to 9.3.10 and 10.0.10 have a flaw in the PDF creation process that lets a remote user modify a request and skip normal checks. This could allow attackers to view or manipulate documents they shouldn't see. Install the provided update from the vendor as soon as possible to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
–	espocrm	9.3.0

Original advisory text

EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.

References

https://github.com/espocrm/espocrm/ Exploit
https://github.com/espocrm/espocrm/commit/91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bc... Patch
https://github.com/espocrm/espocrm/security/advisories/GHSA-w46f-mj7x-v5c6 Exploit
https://vuldb.com/submit/1010801 Vendor Advisory
https://vuldb.com/vuln/422794 Vendor Advisory
https://vuldb.com/vuln/422794/cti Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-1136... Vendor Advisory
https://github.com/espocrm/espocrm/security/advisories/GHSA-r277-qh74-r86f Exploit
https://nvd.nist.gov/vuln/detail/CVE-2026-113643 Vendor Advisory
https://vuldb.com/cve/CVE-2026-113643 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-639Authorization Bypass Through User-Controlled Key

CWE-285Improper Authorization

Timeline

Published20 Oct 2026

Updated4 Nov 2026

First seen20 Oct 2026

Sources

CVE-2026-113643 · NVD

CVE-2026-113643 · MITRE

CVE-2026-113643 · OSV

Track software like this

Free during beta