EUVD-2026-102094

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hid...

CVE-2026-46694

The open-source customer relationship management application EspoCRM is vulnerable to an ACL bypass in versions prior to 9.3.7 . A portal user with stream access to a parent record can directly fetch and read internal stream notes via the portal Note API if they possess the note identifier. While...

EspoCRM <= 9.3.3 - Server-Side Request Forgery

EspoCRM = 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost, letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. id: CVE-2026-33534...

CVE-2026-109958

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

CVE-2026-109959

EspoCRM versions 4.0.0 before 10.0.7 are vulnerable to an access control flaw. Authenticated users with stream access to a parent record can bypass the NoteAccessControl filter by requesting GET /Note/{id}. This allows them to read audited field values restricted by field-level security , specifi...

CVE-2026-109959 EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/id, which skips the...

CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

CVE-2026-109958

EspoCRM version 4.0.0 before 10.0.7 is vulnerable to an improper access control vulnerability. Authenticated users with record access can bypass field-level restrictions to read restricted emailAddress values via the address-book search API . This occurs even when specific Roles are configured to...

CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

CVE-2026-109957 EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachme...

CVE-2026-109957

Versions of EspoCRM prior to 10.0.7 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw. This vulnerability exists in the Import endpoint , where authenticated users with Import scope access can read attachments belonging to other users by providing a foreign attachmentId . An attac...

CVE-2023-5965

PoC for Espo CRM 7.2.4 CVE-2023-5965 & CVE-2023-5965 CVE-2023-5965 Advisory An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution. To upload the file go to...

CVE-2026-105831

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...

CVE-2026-105832

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-105833

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

CVE-2026-105832

EspoCRM versions before 10.0.6 are vulnerable to an authentication bypass flaw where the system accepts a login that is stopped at the second factor on routes not requiring authentication. An attacker possessing a 2FA-enabled user's credentials can bypass the second factor to access config parame...

CVE-2026-105832 EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-105832

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

EUVD-2026-95019

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-105833 EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...