CVE-2026-46694 EspoCRM CVE debrief

Who should care

EspoCRM administrators and security teams should assess exposure and upgrade to 9.3.7. They should review user access controls, monitor for unauthorized access attempts, and implement compensating controls if necessary. Affected deployments should prioritize the upgrade to prevent unauthorized access to internal stream notes. Security teams should verify that their deployments are not exposed and review user access controls. They should also track relevant

Why it matters

CVE-2026-46694 allows EspoCRM portal users to bypass ACL and access internal stream notes. Defenders should upgrade to 9.3.7, review user access controls, and monitor for unauthorized access attempts.

• Portal users can access internal stream notes, potentially exposing sensitive information
• Compensating controls may be needed until upgrade to 9.3.7 can be implemented
• Verification of user access controls and stream note permissions is necessary

Technical summary

CVE-2026-46694: EspoCRM portal users can bypass ACL to access internal stream notes. Versions before 9.3.7 are affected. The vulnerability allows portal users to directly fetch internal stream notes through the portal Note API. This issue is addressed in version 9.3.7, which corrects the ACL bypass vulnerability. Affected deployments should upgrade to prevent unauthorized access to sensitive information. The fix prevents portal users from accessing internal stream notes without proper authorization. No additional technical details on the vulnerability or exploitability are provided.

Defensive priority

Medium priority for EspoCRM administrators and security teams

Recommended defensive actions

• Upgrade EspoCRM to version 9.3.7 or later
• Review and restrict portal user stream access
• Monitor for unauthorized note access attempts
• Verify that compensating controls are in place for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

CVE Program and NVD records confirm EspoCRM 9.3.6 and earlier allow portal users with stream access to fetch internal notes via Note API. The vulnerability is fixed in version 9.3.7. Defenders should verify that their deployments are not exposed and review user access controls. Evidence from official sources indicates that the fix addresses the ACL bypass issue. No additional details on exploitability or affected deployments are provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.