Field-Level Security Bypass in EspoCRM Affects Meeting and Call Attendee Data

CVE-2026-90934

What is CVE-2026-90934?

EspoCRM, prior to version 10.0.4, is susceptible to a field-level security bypass vulnerability that compromises the confidentiality of meeting and call attendee information. This vulnerability arises from improper access control list (ACL) validation, permitting authenticated users to retrieve email addresses that should otherwise remain hidden. The flaw specifically checks permissions against the parent event instead of the attendee entity, enabling potential attackers to exploit these endpoints and access restricted data.

References