Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: espocrm 10.0.7 Clear all filters
TI-2026-71726 CVE-2026-109959 · GHSA-574v-qh2p-6g7r

Field-level security bypass in EspoCRM via note read endpoint

Priority LOW 23

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00223 Published 2026-10-13 Fixed in 10.0.7 CWE-200
TI-2026-71725 CVE-2026-109958 · GHSA-98c7-3m9j-hm6f

Field-level access bypass in EspoCRM address-book search

Priority LOW 23

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00223 Published 2026-10-13 Fixed in 10.0.7 CWE-200
TI-2026-71724 CVE-2026-109957 · GHSA-hv9x-x7p8-5xpf

Insecure direct object reference in EspoCRM Import lets users read attachments

Priority LOW 23

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-10-13 Fixed in 10.0.7 CWE-639