EspoCRM CVE-2026-77460

Exploitation requires an authenticated EspoCRM user who holds BOTH edit access to an email template AND mass-email sending access; alternatively, a regular user who can edit the template selected for an administrator-controlled group email auto-reply. The trigger is that per-user ACL application is disabled during mass-email/auto-reply rendering (the renderer called withApplyAcl(false)), so no filtering of FORBIDDEN/INTERNAL/ONLY_ADMIN fields occurs. Limiting factors: the attacker must already possess these specific privileges (not a default role for ordinary users), the product must be running a version prior to 10.0.3, and impact is limited to disclosure of restricted record/user fields - no code execution, data modification, or availability impact. No victim user interaction is required to trigger the rendering.

This is a moderate-severity information-disclosure flaw (CWE-639, broken access control) best characterized as a medium real-world priority rather than an urgent one. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) and the description agree on the key constraint: exploitation is network-reachable but requires an authenticated insider who already holds BOTH email-template edit access and mass-email sending access (PR:L), so this is an authorization-boundary bypass by a privileged-but-not-admin user, not a remote unauthenticated compromise. Publicly available exploit material exists (the GitHub Security Advisory GHSA-28w2-h88g-6vgv, the fix commit b3309f8, and the 10.0.3 release), which raises reproducibility, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - exploitation status is 'publicly available exploit code exists,' which must not be conflated with in-the-wild activity. The impact is confined to disclosure (I:N/A:N); the vendor-assigned C:H reflects exposure of fields explicitly marked FORBIDDEN/INTERNAL/ONLY_ADMIN, though the practical sensitivity depends on which restricted user fields a given deployment holds. Net: a legitimate issue to patch promptly in multi-user EspoCRM installs, but the insider-privilege precondition and absence of KEV/EPSS signals argue against treating it as an emergency.

A non-admin EspoCRM user who has been granted email-template editing and mass-email sending rights crafts a template that references record fields normally restricted by ACL (e.g. fields flagged internal or admin-only). Because the renderer stops applying per-user ACL filtering during mass-email/auto-reply rendering, the generated messages expose those restricted user fields to the attacker (and to recipients). A public advisory and fix commit document the exact behavior and the vulnerable code paths.