CVE-2026-53574 espocrm CVE debrief

Who should care

Defenders responsible for EspoCRM installations, particularly those with authenticated non-administrator users, should assess exposure and prioritize patching to prevent potential privilege escalation and data extraction.

Why it matters

CVE-2026-53574 is a high-severity vulnerability in EspoCRM that allows authenticated non-administrators to perform Boolean-based blind SQL injection, potentially leading to privilege escalation and data extraction. Defenders should prioritize patching to version 9.3.8 or later.

• Potential privilege escalation for authenticated non-administrators
• Possible extraction of arbitrary database information
• Potential exposure of active administrator session tokens

Technical summary

The vulnerability exists in the streamAttachments endpoint of EspoCRM, allowing an authenticated non-administrator to perform Boolean-based blind SQL injection by submitting a crafted 'where' parameter. This can lead to the extraction of arbitrary database information, including active administrator session tokens, and enable full privilege escalation. The issue is fixed in version 9.3.8. An attacker can exploit this vulnerability to extract arbitrary database information, including active administrator session tokens, and enable full privilege escalation. Defenders should prioritize patching to prevent potential privilege escalation and data extraction.

Defensive priority

Defenders should prioritize patching to prevent potential privilege escalation and data extraction.

Recommended defensive actions

• Patch EspoCRM to version 9.3.8 or later
• Restrict access to the streamAttachments endpoint
• Monitor for suspicious database queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fixed version. The vulnerability exists in EspoCRM versions 8.1.0 through 9.3.7. An authenticated non-administrator can exploit this vulnerability by submitting a crafted 'where' parameter to the GET entity streamAttachments endpoint, allowing for Boolean-based blind SQL injection. This can lead to the extraction of arbitrary database information, including active administrator session tokens, and enable full privilege escalation. Defenders should

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.