CVE-2026-113643 | EspoCRM up to 9.3.10/10.0.10 PDF Rendering Pipeline ImageSourceProvider.php ImageSourceProvider::get id authorization (GHSA-r277-qh74-r86f/GHSA-w46f-mj7x-v5c6)

October 20, 2026 Yanac

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. It has been rated as problematic. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass.

This vulnerability was named CVE-2026-113643. The attack may be initiated remotely. There is no available exploit.

It is suggested to install a patch to address this issue.VulDB Recent EntriesRead More