CVE-2026-113643 - Vulnerability Details

- EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization

Description

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.

Published: 2026-10-20

Score: 5.3 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

A bug in EspoCRM’s PDF Rendering Pipeline in versions up to 9.3.10 and 10.0.10 allows a remote attacker to manipulate the ID argument passed to ImageSourceProvider::get. This results in an authorization bypass, letting the attacker retrieve image data that should be protected. The flaw is a classic authorization flaw (CWE‑285) combined with user‑controlled key misuse (CWE‑639).

Affected Systems

Affected product is EspoCRM, all releases up to 9.3.10 and 10.0.10. The vulnerability resides in the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php. No other versions are presently identified as impacted.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.3, indicating a medium severity. No EPSS data is reported, so exploit likelihood is unknown but not documented. The issue is not listed in CISA’s KEV catalog. The attack can be carried out remotely by sending crafted requests that manipulate the ID value; no privileged system access is required. The exploit path exposes an unsecured method that lacks proper permission checks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

EspoCRM

affected

Version	Status	Constraints
`9.3.0`	affected	—
`9.3.1`	affected	—
`9.3.2`	affected	—
`9.3.3`	affected	—
`9.3.4`	affected	—
`9.3.5`	affected	—
`9.3.6`	affected	—
`9.3.7`	affected	—
`9.3.8`	affected	—
`9.3.9`	affected	—
`9.3.10`	affected	—
`10.0.0`	affected	—
`10.0.1`	affected	—
`10.0.2`	affected	—
`10.0.3`	affected	—
`10.0.4`	affected	—
`10.0.5`	affected	—
`10.0.6`	affected	—
`10.0.7`	affected	—
`10.0.8`	affected	—
`10.0.9`	affected	—
`10.0.10`	affected	—

No data.

Vendor Product Confidence Versions

Espocrm

95%

Version	Status	Scheme	Platform
`9.3.0`	affected	semver	—
`9.3.1`	affected	semver	—
`9.3.2`	affected	semver	—
`9.3.3`	affected	semver	—
`9.3.4`	affected	semver	—
`9.3.5`	affected	semver	—
`9.3.6`	affected	semver	—
`9.3.7`	affected	semver	—
`9.3.8`	affected	semver	—
`9.3.9`	affected	semver	—
`9.3.10`	affected	semver	—
`10.0.0`	affected	semver	—
`10.0.1`	affected	semver	—
`10.0.2`	affected	semver	—
`10.0.3`	affected	semver	—
`10.0.4`	affected	semver	—
`10.0.5`	affected	semver	—
`10.0.6`	affected	semver	—
`10.0.7`	affected	semver	—
`10.0.8`	affected	semver	—
`10.0.9`	affected	semver	—
`10.0.10`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor patch referenced by commit 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2 which removes the vulnerability.
Add or enforce an authorization check in ImageSourceProvider::get to confirm the current user has permission to access the image resource before returning data.
Validate and sanitize the ID parameter so that only legitimate identifiers are accepted and reject any malformed or unauthorized values.
If the patch cannot be applied immediately, block external access to the PDF rendering endpoint until a fix is in place.

Generated by OpenCVE AI on October 20, 2026 at 19:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/espocrm/espocrm/
https://github.com/espocrm/espocrm/commit/91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2
https://github.com/espocrm/espocrm/security/advisories/GHSA-r277-qh74-r86f
https://github.com/espocrm/espocrm/security/advisories/GHSA-w46f-mj7x-v5c6
https://vuldb.com/cve/CVE-2026-113643
https://vuldb.com/submit/1010801
https://vuldb.com/vuln/422794
https://vuldb.com/vuln/422794/cti

History

Tue, 20 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.
Title		EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization
First Time appeared		Espocrm Espocrm espocrm
Weaknesses		CWE-285 CWE-639
CPEs		cpe:2.3:a:espocrm:espocrm::::::::
Vendors & Products		Espocrm Espocrm espocrm
References		https://github.com/espocrm/espocrm/ https://github.com/espocrm/espocrm/commit/91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2 https://github.com/espocrm/espocrm/security/advisories/GHSA-r277-qh74-r86f https://github.com/espocrm/espocrm/security/advisories/GHSA-w46f-mj7x-v5c6 https://vuldb.com/cve/CVE-2026-113643 https://vuldb.com/submit/1010801 https://vuldb.com/vuln/422794 https://vuldb.com/vuln/422794/cti
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}`

Subscriptions

Espocrm Espocrm

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-20T18:15:12.276Z

Updated: 2026-10-20T18:45:14.681Z

Reserved: 2026-10-20T13:53:10.882Z

Link: CVE-2026-113643

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-10-20T19:17:32.590

Modified: 2026-10-20T19:17:32.770

Link: CVE-2026-113643

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-20T20:00:15Z

Weaknesses

CWE-285
Improper Authorization
CWE-639
Authorization Bypass Through User-Controlled Key

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object