Improper Access Control in EspoCRM Affects User Privacy
CVE-2026-109958

5.3MEDIUM

Key Information:

Vendor

Espocrm

Status
Espocrm
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109958?

EspoCRM prior to version 10.0.7 is impacted by an improper access control issue that permits authenticated users to access sensitive email address information. This vulnerability arises from the address-book search API that fails to adequately enforce role restrictions on the emailAddress field, allowing users with record access privileges to retrieve email addresses even when their roles should limit such access.

Affected Version(s)

espocrm 4.0.0 < 10.0.7

espocrm 10.0.7

References

https://github.com/espocrm/espocrm/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/espocrm-4.0.0-before...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

d3do-23
.