The vulnerability is an access control bypass in EspoCRM's mass‑update functionality. An authenticated user possessing mass‑update permission can supply a known attachment identifier, causing the system to duplicate the attachment without verifying that the caller has read access. This action bypasses record‑level and field‑level restrictions and exposes the file contents through the duplicated attachment. The flaw is a classic authorization weakness (CWE‑862) and can lead to unauthorized disclosure of sensitive files.

EspoCRM espocrm versions prior to 10.0.2 are vulnerable. The issue is fixed in version 10.0.2 and later.

The CVSS score is 6, indicating medium severity. The EPSS score is less than 1%, implying a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker must first authenticate to the system and possess mass‑update permission. Once those prerequisites are met, the attacker can supply any known attachment identifier to copy and expose the file. Because the vulnerability requires a valid attachment ID, the attack vector is primarily internal or through compromised accounts, and the overall risk is moderate but mitigated by the low exploitation likelihood.