Cross-site request forgery in EspoCRM - CVE-2026-126306
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU162635
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126306
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker to elevate their own account to administrator through an administrator's authenticated session.
The vulnerability exists due to unsafe handling of uploaded SVG attachments in EspoCRM, allowing image clicks to submit authenticated POST requests to arbitrary backend endpoints. A low-privileged remote attacker can upload a crafted SVG and trigger privileged actions when an administrator opens it in a separate browser tab and clicks the image.
Affected software
EspoCRM
How to mitigate CVE-2026-126306
Install security update from vendor's website.
EspoCRM - addressed in versions 9.3.11, 10.0.8