An insecure direct object reference exists in EspoCRM versions before 10.0.7. Authenticated users who have Import permissions can supply a foreign attachmentId to the Import endpoint, causing the system to fetch data linked to that attachment. By creating an import record that references a known attachment ID and then calling the error export endpoint, the attacker can extract the associated data into a CSV for download. This allows the disclosure of attachments belonging to other users without authorization, impacting confidentiality and potentially revealing sensitive business information.

The vulnerability affects EspoCRM software (espocrm:espocrm) prior to version 10.0.7. Any deployment running an affected version, regardless of configuration, is at risk if a user with Import scope is present. The most recent public fix is available in version 10.0.7 and later.

The CVSS score of 5.3 reflects a moderate severity due to limited user scope and no impact on system integrity or availability. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, suggesting lower probability of widespread exploitation. Attackers must authenticate, possess Import permission, and know a valid attachmentId. The exploitation flow requires two steps: (1) create an Import specifying a foreign attachmentId, and (2) invoke the error export endpoint to obtain the data, which is only possible if the application processes the request without additional validation. Because the pathway relies on web API endpoints, the attack vector is remote but requires legitimate credentials.