Improper Access Control in EspoCRM Exposes Restricted Email Addresses

Executive Summary

EspoCRM versions up to 10.0.6 have an improper access control flaw in the address-book search API. Authenticated users with record access can bypass field-level restrictions to read emailAddress values even when roles explicitly block access to this field. The issue stems from incorrect authorization checks (CWE-863) and improper handling of sensitive data exposure (CWE-200).

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your EspoCRM version is below 10.0.7. Use commands like 'curl -X GET http://your-espocrm-instance/api/v1/AddressBook' with valid credentials to test if restricted emailAddress values are returned despite ACL restrictions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to access restricted email addresses through a simple API query. Attackers with basic access can retrieve sensitive contact information they shouldn't see, potentially leading to privacy breaches or further targeted attacks using the exposed data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates data protection regulations like GDPR and HIPAA by exposing personal data (email addresses) without proper authorization. It represents a failure to implement adequate access controls for sensitive information, which could result in regulatory penalties and loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade EspoCRM to version 10.0.7 or later. Review and enforce role-based access controls to ensure emailAddress fields are properly restricted. Monitor API logs for suspicious address-book search queries.

Useful 0 Not Useful 0