The flaw is in EspoCRM’s handling of opt‑out and cancel‑opt‑out operations performed through a shared TargetList. A user with limited privileges can trigger these actions on a Contact or Lead that the user is not authorized to read or edit. Because the service validates only the TargetList permissions but then retrieves the target record without enforcing record‑level access checks, the user can change the opted_out relationship state of that record. The change modifies the record’s opt‑in status, potentially affecting communication preferences and causing unauthorized data modification.

EspoCRM targeted by the vulnerability runs on all versions earlier than 9.3.7. The affected product is EspoCRM (vendor: espocrm) and the patch is available in release 9.3.7.

The CVSS score of 4.3 reflects a moderate severity, and the EPSS value of less than 1% indicates a very low probability of exploitation at present. The issue is not listed in CISA’s KEV catalog. The attack requires an authenticated user with access to a shared TargetList, so it is an internal threat that relies on compromising the user’s privileges within the application. While the impact does not allow complete compromise, it permits unauthorized alteration of contact or lead opt‑out status, which could be leveraged to disrupt marketing communications or erode data integrity.