CVE-2026-46708
EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record
CVSS score
4.3
EPSS probability
—
Risk score
0.4
Published
6 h ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
9.1
CVE-2026-47168
EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params
E
Patch status unknown
7.6
CVE-2026-53574
EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
E
Patch status unknown
6.5
CVE-2026-77460
EspoCRM: Mass email template renderer leaks restricted record fields
E
Patch status unknown
6.5
CVE-2026-46691
EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users
E
Patch status unknown
6.5
CVE-2026-46694
EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes
E
Patch status unknown
6.0
CVE-2026-75505
EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment
E
Patch status unknown
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-46708"