EspoCRM’s Import/exportErrors endpoint allows an authenticated user with Import scope to request a CSV containing rows from another user’s import operation by providing that user's import identifier. The endpoint verifies only the user’s Import scope level but omits the entity‑level ownership check performed by the Import AccessChecker, allowing a user to obtain a download link for a CSV belonging to a different user, thereby exposing potentially sensitive or proprietary data.

EspoCRM” versions prior to 9.3.7 are affected. The vulnerability is present in the Import module’s RESTful endpoint POST / api/v1/Import/{id}/exportErrors for authenticated users possessing Import scope.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1 % suggests a low likelihood of widespread exploitation. It is not currently in the CISA KEV catalog. Exploitation requires only that the attacker have Import scope within the system, so it typically involves an authenticated internal threat or a compromised user account. Once an attacker supplies another user’s import identifier, the response returns a shared attachment identifier for the CSV which can be downloaded to read the data.