EspoCRM allows an authenticated non‑administrator to craft the where parameter for the GET entity streamAttachments endpoint, which permits complex expressions. The application is vulnerable to boolean‑based blind SQL injection, enabling the attacker to extract arbitrary data from the database, including active administrator session tokens, and to achieve full privilege escalation. This flaw is an instance of SQL injection (CWE‑89).

Vendors and products affected are EspoCRM EspoCRM, with all releases from version 8.1.0 up to and including 9.3.8 vulnerable. No other versions are listed as impacted.

The CVSS score of 7.6 indicates a high severity potential, while the EPSS score of below 1 % signifies a very low probability of exploitation in the wild. The flaw is not listed as a known exploited vulnerability in the CISA KEV catalog. Exploitation requires authenticated access by a non‑administrator, making the attack vector local to users with valid credentials, but the impact is significant once achieved.