EspoCRM Field-Level Security Bypass via Stream Note Access

Executive Summary

This vulnerability affects EspoCRM versions up to 10.0.6. It involves the Note read functionality not applying Access Control List (ACL) output filters to audit data, exposing field values restricted by field-level security. The GET /Note/{id} endpoint does not strip restricted fields from stream update notes, allowing users with access to a parent record's stream to recover previous and new values of restricted fields marked as audited.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check EspoCRM versions before 10.0.7. Use commands like 'curl -X GET http://your-espocrm-instance/Note/{id}' to test if restricted field values are exposed via the Note endpoint. Monitor logs for unauthorized access attempts to /Note/{id} endpoints.

Useful 0 Not Useful 0

Impact Analysis

Authenticated users with stream access to a parent record can exploit this to read sensitive data from fields they are restricted from accessing. This includes recovering previous and new values of restricted fields, potentially exposing confidential information stored in audited fields.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal or health data, violating GDPR and HIPAA compliance. Exposure of restricted fields may result in data breaches, triggering regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade EspoCRM to version 10.0.7 or later. Ensure no users have unnecessary stream access to parent records. Review and restrict field-level security settings for audited fields. Monitor network traffic for suspicious requests to /Note/{id} endpoints.

Useful 0 Not Useful 0