EUVD-2026-98662
GHSA-98c7-3m9j-hm6f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitQuery address-book search API
-
ExecutionBypass field-level Role restriction
-
ImpactHarvest restricted email addresses
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated EspoCRM account (PR:L) that has record access and is subject to a Role configuration that restricts the emailAddress field - the flaw is that the address-book search API does not honor this field-level restriction. The practical prerequisite is therefore a deployment that relies on Role-based field-level access control to hide email addresses from certain users; environments that do not restrict the emailAddress field have nothing to leak. Limiting factors: attacker must hold valid credentials with record access, the exposure is read-only, and only data covered by the misconfigured field restriction (email addresses) is disclosed. Affected versions are EspoCRM 4.0.0 through versions before 10.0.7. |
| Impact | This is a genuine but low-urgency issue, correctly rated CVSS 5.3 (medium). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires authenticated access (PR:L) and yields only low confidentiality impact (VC:L) with no integrity or availability effect - consistent with CWE-200 information disclosure. Publicly available exploit code exists via the GHSA advisory, which lowers the practical barrier to abuse, but the vulnerability is NOT in CISA KEV and there is no evidence of active exploitation. No EPSS score was provided, so widespread opportunistic exploitation cannot be quantified from the input. The key limiting factor is that an attacker must already be an authenticated user with record access, making this primarily an insider/privilege-boundary bypass (field-level access control circumvention) rather than a remote unauthenticated breach. Net: real and worth patching because a POC is public, but not an emergency given the authentication requirement and the narrow, read-only data exposure. |
| Exploit ScenarioDerived | An authenticated EspoCRM user whose Role is configured to hide the emailAddress field queries the address-book search API endpoint, which fails to enforce the same field-level restriction. The returned search results leak the restricted email addresses, bypassing the intended Role policy. A public proof-of-concept is referenced in the vendor's GitHub security advisory (GHSA-2cr7-9g4f-8723). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
EspoCRM versions 4.0.0 through 10.0.6 allow authenticated users to read email addresses that Role-based field-level restrictions are supposed to conceal, because the address-book search API does not enforce the emailAddress field permission. An attacker only needs a valid account with record access plus a deployment that relies on Roles to hide emailAddress from that user; environments that do not restrict the field have nothing to leak. Publicly available exploit code exists, though the impact is read-only disclosure and the issue has been assessed as a medium-severity, low-urgency information exposure (CVSS 5.3) with no indication of confirmed active exploitation in the wild.
RemediationAI
The vendor-released patch is EspoCRM 10.0.7 - upgrade from any 4.0.0-through-10.0.6 release to 10.0.7 or later, as documented in the upstream advisory GHSA-2cr7-9g4f-8723 and the VulnCheck advisory at https://www.vulncheck.com/advisories/espocrm-4.0.0-before-10.0.7-field-level-access-bypass-via-address-book-search. If upgrading immediately is not possible, remove the address-book search capability or the underlying search permission from any Role that also restricts emailAddress, understanding that this degrades legitimate contact lookup for those users; alternatively, stop relying on Role-based field hiding for email addresses, since an attacker with record access and valid credentials can still enumerate them through this endpoint, and treat affected email addresses as already exposed by rotating or reclassifying them where they are sensitive. Because exploitation requires a valid authenticated account, tighten account provisioning and disable unused or stale users to shrink the population that could exercise the bypass, and review EspoCRM access logs for anomalous address-book search queries while the patch is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an access-control enforcement gap (CWE-200, exposure of sensitive information) in EspoCRM's address-book search endpoint, part of the CRM's contact lookup capability that aggregates people records such as Contacts, Leads and Accounts. EspoCRM implements authorization through Roles, which can grant or deny access at both record level and field level; the bug is that the address-book search API honors record-level access but bypasses the field-level restriction on emailAddress, returning values that the Role configuration was meant to hide. The CPE cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:* identifies EspoCRM as the affected product across the vulnerable version range. Because the vulnerability depends on a Role that explicitly denies the emailAddress field, it is a configuration-sensitive access-control bypass rather than a memory-safety or injection defect: the data source is legitimate, only the authorization check is missing.
Know when Espocrm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-accessible API with low complexity, but requires an authenticated low-privileged account (PR:L); only partial confidentiality loss of email addresses, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the emailAddress field.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local
PHP object deserialization in EspoCRM versions prior to 9.3.7 lets an authenticated administrator achieve remote code ex
Path traversal in EspoCRM's formula scripting engine allows authenticated administrators to achieve arbitrary file read/
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any ext
EspoCRM 5.6.4 is vulnerable to user password hash enumeration. Rated high severity (CVSS 8.8), this vulnerability is rem
Authorization bypass in EspoCRM 5.8.5 lets an authenticated low-privilege user reuse or manipulate Basic-Authorization a
EspoCRM deployments before 10.0.5 allow an authenticated user with Email Account scope to retrieve other users' stored I
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating
Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to i
Path traversal in EspoCRM admin template management allows authenticated administrators to read, create, overwrite, or d
Server-side request forgery in EspoCRM before 10.0.4 allows authenticated users to route outbound HTTP requests to inter
Stored cross-site scripting in EspoCRM 9.3.3 and below enables an authenticated attacker to execute arbitrary JavaScript
Exploit-DB