EUVD-2026-77452
GHSA-w9v2-8542-444h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authentication required (PR:L); impact limited to reading restricted email addresses (C:L); no integrity or availability impact is described in the vulnerability.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.
AnalysisAI
Field-level security bypass in EspoCRM before 10.0.4 exposes hidden attendee email addresses to any authenticated user through the meeting and call attendees API endpoints. The root cause is ACL validation logic that checks parent event (meeting or call) permissions rather than per-attendee entity permissions, rendering field-level email restrictions ineffective for all users with event read access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated EspoCRM user account with at least read access to Meeting or Call records - PR:L per the CVSS vector confirms authentication is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (VC:H/VI:H/VA:H, score 8.7) is substantially overstated relative to the described impact, which is limited to reading hidden email addresses - a confidentiality-only concern with no described integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade EspoCRM to version 10.0.4 or later, which corrects the ACL scope validation logic to evaluate attendee entity permissions rather than parent event permissions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all EspoCRM deployments to identify instances running versions prior to 10.0.4 and review API access logs for suspicious queries to meeting or call attendees endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today