CVE-2026-41141
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedEspoCRM is an open source customer relationship management application. Prior to 9.3.5, the POST /api/v1/EmailTemplate/:id/prepare endpoint accepts an emailAddress parameter and resolves the owning entity (Contact, Lead, Account, or User) without performing an ACL check. An authenticated user with EmailTemplate read permission can extract all field values of any entity by supplying the target's email address, bypassing read: own or read: team ACL restrictions. This vulnerability is fixed in 9.3.5.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceEspoCRM prior to 9.3.5 contains an ACL bypass vulnerability in the POST /api/v1/EmailTemplate/:id/prepare endpoint. The endpoint accepts an emailAddress parameter and resolves the owning entity (Contact, Lead, Account, or User) without performing any ACL check, allowing an authenticated user with only EmailTemplate read permission to extract all field values of any entity by supplying the target's email address, bypassing read:own and read:team restrictions.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify EspoCRM installed versionLocate the version file (typically version.php in the root directory or in /application/Espo/Classes) or query the API endpoint /api/v1/App metadata to retrieve the version numberAffected if Version is 9.3.4 or lower (prior to 9.3.5)
-
Verify the EmailTemplate prepare endpoint existsConfirm the REST API endpoint /api/v1/EmailTemplate/{id}/prepare is available by reviewing the router configuration or attempting a test request with a valid authentication tokenAffected if Endpoint exists and accepts POST requests with emailAddress parameter
-
Review user role ACL configurationAccess the administration panel, navigate to Roles or ACL, and examine the permissions assigned to the role in question. Specifically check if a role grants only EmailTemplate (read) permission without granting read access to Contacts, Leads, Accounts, or UsersAffected if A role exists with EmailTemplate read permission but lacks read:own or read:team permissions on Contact, Lead, Account, or User entities
-
Test the ACL bypass manually (optional)Using an API client with credentials having only EmailTemplate read permission, send a POST request to /api/v1/EmailTemplate/{id}/prepare with an emailAddress parameter set to a target email address belonging to a different user. Observe if the response returns entity field data without permission denialAffected if Request returns entity data (such as name, email, phone) for the target entity despite insufficient ACL permissions
Your environment is affected if EspoCRM version is below 9.3.5 AND the /api/v1/EmailTemplate/:id/prepare endpoint is accessible to users who lack read permissions on the target entity type.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade to EspoCRM version 9.3.5 or later which contains the fix for this ACL bypass vulnerability.
9.3.5
- 1. Back up your current EspoCRM installation and database before upgrading.
- 2. Download EspoCRM version 9.3.5 from the official GitHub repository or the official website.
- 3. Extract the new version files to replace your existing installation, or use the built-in upgrade mechanism if available.
- 4. Verify the upgrade was successful by logging into the application.
- 5. Confirm the /api/v1/EmailTemplate/:id/preview endpoint now performs proper ACL checks before returning entity data.
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation1.0 h
- Implementation1.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,376.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-41141 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-41141 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data