CVE-2026-46694
EspoCRM is an open source customer relationship management application.
Published Oct 15, 2026 · updated Oct 15, 2026
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hide notes whose isInternal field is true, but the direct single-Note access check does not enforce that restriction, exposing internal agent content. This issue is fixed in version 9.3.7.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hide notes whose isInternal field is true, but the direct single-Note access check does not enforce that r
Oct 15, 2026 · NIST NVD
Updated
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hide notes whose isInternal field is true, but the direct single-Note access check does not enforce that r
Sources
- CVE.orgVulnerability recordCVE-2026-46694
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-46694
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list respon
nvd.nist.gov