Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

65 records

Vendor: espocrm Clear all filters
TI-2026-82174 CVE-2026-118686 · GHSA-jv3j-8935-75r6

EspoCRM Unauthenticated Denial of Service via Password-Redaction Regex

Priority MEDIUM 44

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00347 Published 2026-10-28 Fixed in 10.0.8, 9.3.11 CWE-1333
TI-2026-71726 CVE-2026-109959 · GHSA-574v-qh2p-6g7r

Field-level security bypass in EspoCRM via note read endpoint

Priority LOW 23

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00223 Published 2026-10-13 Fixed in 10.0.7 CWE-200
TI-2026-71725 CVE-2026-109958 · GHSA-98c7-3m9j-hm6f

Field-level access bypass in EspoCRM address-book search

Priority LOW 23

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00223 Published 2026-10-13 Fixed in 10.0.7 CWE-200
TI-2026-71724 CVE-2026-109957 · GHSA-hv9x-x7p8-5xpf

Insecure direct object reference in EspoCRM Import lets users read attachments

Priority LOW 23

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-10-13 Fixed in 10.0.7 CWE-639
TI-2026-69538 CVE-2026-105833 · GHSA-8wxm-j7r5-j4mp

IDOR in EspoCRM PersonalAccount service exposes IMAP passwords

Priority LOW 35

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.0022 Published 2026-10-08 Fixed in 10.0.5 CWE-522
TI-2026-69537 CVE-2026-105832 · GHSA-9h5f-ghfx-jfjc

Two-factor authentication bypass in EspoCRM on unauthenticated routes

Priority LOW 24

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00266 Published 2026-10-08 Fixed in 10.0.6 CWE-287
TI-2026-69536 CVE-2026-105831 · GHSA-qv95-q49f-g838

Stored HTML injection in EspoCRM Lead Capture log records

Priority LOW 24

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00267 Published 2026-10-08 Fixed in 10.0.6 CWE-79
TI-2026-62289 CVE-2026-92298 · GHSA-2p88-mrx2-p76v

EspoCRM through 10.0.8 Weak Token Generation via rand()

Priority LOW 28

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0043 Published 2026-09-16 No fix listed CWE-338
TI-2026-61798 CVE-2026-90934 · GHSA-w9v2-8542-444h

EspoCRM before 10.0.4 Field-level Security Bypass via Attendees

Priority LOW 39

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00305 Published 2026-09-14 Fixed in 10.0.4 CWE-863
Load more