Access Control Flaw in EspoCRM Affects User Information Exposure
CVE-2026-77460

6.5MEDIUM

Key Information:

Vendor

Espocrm

Status
Espocrm
Vendor
CVE Published:
15 October 2026

What is CVE-2026-77460?

EspoCRM, an open source customer relationship management application, suffers from an access control vulnerability. Users with permissions to edit email templates and send mass emails can inadvertently access restricted record fields due to insufficient filtering. This issue arises when per-user Access Control Lists (ACL) are not applied, allowing regular users editing group email templates to expose sensitive user information. The vulnerability impacts both email templates and group email auto-replies, revealing restricted fields even when administrators control group emails. This issue has been addressed in version 10.0.3.

Affected Version(s)

espocrm < 10.0.3

References

https://github.com/espocrm/espocrm/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/espocrm/espocrm/commit/b3309f8b2060e77...
x_refsource_MISC
https://github.com/espocrm/espocrm/releases/tag/10.0.3
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.