PT-2026-114957

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.7 Description An authenticated administrator can provide crafted serialized PHP object data stored in background MassAction or Export parameters. The application later deserializes this data without restricting...

PT-2026-114962

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.9 Description An unauthenticated remote attacker can send an email to a monitored group or IMAP address, such as an email-to-Case address, containing arbitrary HTML within the plain-text body. The application stor...

CVE-2026-75505: Missing Authorization

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...

CVE-2026-46694: Missing Authorization

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hid...

CVE-2026-109958

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

CVE-2026-109957

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachme...

CVE-2026-109959 EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/id, which skips the...

CVE-2026-109959

EspoCRM versions 4.0.0 before 10.0.7 are vulnerable to an access control flaw. Authenticated users with stream access to a parent record can bypass the NoteAccessControl filter by requesting GET /Note/{id}. This allows them to read audited field values restricted by field-level security , specifi...

CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

CVE-2026-109958

EspoCRM version 4.0.0 before 10.0.7 is vulnerable to an improper access control vulnerability. Authenticated users with record access can bypass field-level restrictions to read restricted emailAddress values via the address-book search API . This occurs even when specific Roles are configured to...

CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

CVE-2026-109957 EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachme...

CVE-2026-109957

Versions of EspoCRM prior to 10.0.7 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw. This vulnerability exists in the Import endpoint , where authenticated users with Import scope access can read attachments belonging to other users by providing a foreign attachmentId . An attac...

CVE-2026-109957 EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachme...

CVE-2026-109959: Exposure of Sensitive Information to an Unauthorized Actor

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/id, which skips the...

CVE-2026-109957: Authorization Bypass Through User-Controlled Key

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachme...

CVE-2026-109958: Exposure of Sensitive Information to an Unauthorized Actor

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

PT-2026-111552

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 10.0.7 Description An insecure direct object reference allows authenticated users with Import scope access to read attachments belonging to other users. This occurs when a foreign attachmentId is supplied to the Impor...

CVE-2026-105831

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...

CVE-2026-105832

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...