[ CVE-2026-53574 · Published 15 Oct 2026 ]
Vulnerability in espocrm
CVSS 7.6
EPSS <1%No fix listed yet
[ Description ]Official description
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.