Access Control Flaw in EspoCRM Affects Security of User Data
CVE-2026-109959

5.3MEDIUM

Key Information:

Vendor

Espocrm

Status
Espocrm
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109959?

EspoCRM versions prior to 10.0.7 are susceptible to an access control vulnerability that enables authenticated users to bypass field-level security settings. This flaw allows users with access to a parent record to execute GET requests on individual note entries, circumventing essential filters. As a result, sensitive information within restricted fields can be exposed, compromising the integrity of data protection measures.

Affected Version(s)

espocrm 4.0.0 < 10.0.7

espocrm 10.0.7

References

https://github.com/espocrm/espocrm/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/espocrm-4.0.0-before...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

d3do-23
.