EspoCRM EUVD-2026-95019

Exploitation requires the attacker to already know a valid username AND password for a user who has two-factor authentication enabled; the flaw lets that partially-authenticated login (stopped at the second factor) reach EspoCRM routes that do not enforce full authentication, exposing configuration parameters that are not otherwise public. Limiting factors: it provides NO initial access on its own (first-factor credentials must be compromised beforehand), it is read-only (confidentiality of config only - no write, code execution, or account takeover demonstrated), and it applies to EspoCRM versions before 10.0.6, so patched or 10.0.6+ instances are not affected. No special non-default configuration is required beyond the targeted user having 2FA enabled.

This is a medium-severity (CVSS 5.3) authentication/2FA bypass, and the available signals are internally consistent in pointing to limited, not urgent, real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network reachability and low complexity but requires low privileges - specifically, the attacker must already possess a valid username and password for a 2FA-enabled account - and the impact is confined to confidentiality (VC:L, VI:N, VA:N): reading configuration parameters not meant to be public. CISA SSVC reinforces this: Exploitation=none (no observed in-the-wild activity), Automatable=no, and Technical Impact=partial. A public exploit exists (vendor GHSA advisory) and the issue was reported by VulnCheck, but this is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The principal mitigating factor is that 2FA bypass is only meaningful once an attacker has already compromised the first factor (username + password), which downgrades this from a standalone break to a defense-in-depth failure. Net: a legitimate patch-management priority for EspoCRM operators who rely on 2FA, but not a drop-everything emergency, and its CVSS-indicated 'network/low-complexity' profile should be read alongside the PR:L credential prerequisite rather than as unauthenticated access.

An attacker who has already obtained a 2FA-enabled EspoCRM user's username and password (e.g., via phishing or credential reuse) submits those credentials, reaching the point where the second factor is normally demanded. Instead of completing 2FA, the attacker directs the partially-authenticated session to routes that do not enforce full authentication and retrieves configuration parameters that are not publicly exposed. A public exploit referenced in the vendor's GitHub security advisory (GHSA-ph8v-hvf5-wgp9) demonstrates the bypass.