CVE-2026-41160

Technical summary

CVE-2026-41160 is a broken access control vulnerability in EspoCRM's note-pinning API endpoint (/api/v1/Note/{id}/pin). The root cause is a "write-first-authorize-later" design flaw in application/Espo/Tools/Stream/Api/PostNotePin.php. The process() method retrieves the note object via getNote($id) and persists the pin state change to the database before invoking the authorization check via checkParent($note). Consequently, a low-privileged user can send a POST request to pin an arbitrary note; the authorization failure is detected and a 403 Forbidden response is returned, but the database change has already committed. The vulnerability is resolved in version 9.3.5 by reordering the authorization check to occur before any data modification.

Business impact

This vulnerability enables unauthorized modification of note metadata within CRM records, potentially disrupting workflow visibility, audit trails, and team collaboration. While the integrity impact is localized to note pinning status, repeated exploitation could be used to manipulate CRM state to confuse users or hide important notes from team members. In compliance-heavy industries, unauthorized database modifications—even of seemingly minor fields—may trigger audit concerns and require forensic investigation.

Affected systems

EspoCRM versions prior to 9.3.5 are vulnerable. The flaw requires network access to the application and valid authentication (any low-privileged user account), making it exploitable in environments where CRM access is broadly distributed. Self-hosted and cloud-hosted EspoCRM deployments using affected versions are at risk.

Exploitability

Exploitation requires valid application credentials and network access to the EspoCRM API. The attack is straightforward: a low-privileged user authenticates and sends a POST request to the /api/v1/Note/{id}/pin endpoint targeting notes outside their permission scope. No special tools, social engineering, or complex techniques are required. The CVSS score of 4.3 (MEDIUM) reflects low attack complexity and no special privileges needed beyond basic user access, though impact is limited to note integrity. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade EspoCRM to version 9.3.5 or later. This patch relocates the authorization check to occur before the note state is modified, preventing the write-first-authorize-later flaw. Organizations should verify the patch version against the official EspoCRM advisory before deployment. No workarounds are available; patching is the sole remediation path.

Patch guidance

Administrators should prioritize updating to EspoCRM 9.3.5 or newer. The upgrade process should follow EspoCRM's standard release notes and deployment procedures. Test the patch in a non-production environment first to confirm compatibility with any custom extensions or integrations. After upgrading, verify that the /api/v1/Note/{id}/pin endpoint properly enforces access controls by attempting to pin a note belonging to another user's private workspace with a low-privileged test account; the request should be rejected with a 403 error before any database modification occurs.

Detection guidance

Monitor access logs and API audit trails for suspicious POST requests to /api/v1/Note/{id}/pin from low-privileged users, particularly requests targeting notes they do not own or have no edit permission for. Look for patterns of 403 Forbidden responses preceded by successful database writes (indicating the race condition). Database query logs may show UPDATE operations on the note table followed by a subsequent authorization failure in the application layer. Organizations with detailed API logging should correlate HTTP response codes with database transaction timestamps to identify exploitation attempts.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), this vulnerability merits prompt patching because it demonstrates a fundamental design flaw in API security (authorization after modification) that could indicate similar issues in other EspoCRM endpoints. The low barrier to exploitation (any authenticated user) and the high likelihood that CRM environments have broad user bases make this an attractive target for disgruntled or compromised insiders. Early patching prevents accidental or intentional misuse and closes a potential audit compliance gap.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) Network-accessible attack vector (AV:N); (2) Low attack complexity, no special conditions required (AC:L); (3) Low-privilege attacker (PR:L); (4) No user interaction needed (UI:N); (5) Unchanged scope (S:U); (6) No confidentiality impact (C:N); (7) Low integrity impact limited to note metadata (I:L); (8) No availability impact (A:N). The score appropriately captures the ease of exploitation and authenticated access requirement, offset by the narrow scope of impact (note pinning only) and lack of data exfiltration or denial of service.

Frequently asked questions