Denial of Service Vulnerability in EspoCRM by Espo Technologies
CVE-2026-118686

8.7HIGH

Key Information:

Vendor

Espocrm

Status
Espocrm
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118686?

EspoCRM versions prior to 9.3.11 and 10.0.8 are susceptible to a denial of service attack due to a flaw in the password-redaction regular expression used in API error handling. When targeted by unauthenticated remote attackers, this vulnerability allows them to send several large API requests that trigger excessive CPU consumption, effectively exhausting server workers. This can lead to degradation of service, making the application slow or entirely unavailable to legitimate users.

Affected Version(s)

espocrm 10.0.0 < 10.0.8

espocrm 0 < 9.3.11

espocrm 10.0.8

References

https://github.com/espocrm/espocrm/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/espocrm-before-9.3.1...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AdamKorcz
.