CVE-2026-90934
Received Received - Intake

Field-Level Security Bypass in EspoCRM Exposes Restricted Emails

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90934
EUVD
EUVD-2026-77452

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
espocrm espocrm to 10.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

EspoCRM before version 10.0.4 has a security flaw where authenticated users can bypass field-level restrictions to view hidden email addresses of meeting or call attendees. The system incorrectly checks permissions for the parent event instead of the attendee entity itself, allowing unauthorized access to restricted data.

Detection Guidance

To detect this vulnerability, check if your EspoCRM instance is running a version before 10.0.4. You can verify the version by running SQL queries on the database or checking the version file in the EspoCRM installation directory. For example, run: SELECT VERSION() in your database client or check the version in the file located at application/Espo/Core/Application.php.

Impact Analysis

An attacker with valid credentials could exploit this to recover email addresses that should be hidden, potentially exposing sensitive contact information. This could lead to privacy breaches or further targeted attacks using the disclosed emails.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR or HIPAA by exposing personal data (email addresses) without proper authorization. Organizations using vulnerable versions could face compliance violations, legal penalties, or reputational damage.

Mitigation Strategies

Immediately upgrade EspoCRM to version 10.0.4 or later to patch the vulnerability. If upgrading is not immediately possible, restrict access to the meeting and call attendees endpoints by modifying server firewall rules or using network-level access controls to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90934. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart