CVE-2026-126306
HIGH
NVD
CVSS Score
8
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator.