CVE-2026-77460
Deferred Deferred - Pending Action

Stored XSS in EspoCRM Email Templates

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is disabled. The same behavior affects group email auto-replies when a regular user can edit the selected template, even though an administrator controls the group email. Rendered messages can disclose restricted user fields. This issue is fixed in version 10.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-77460
EUVD
EUVD-2026-102110

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
espocrm espocrm < 10.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

EspoCRM versions before 10.0.3 have a flaw where the email template renderer fails to filter restricted record fields when per-user ACL is disabled. This allows users with email template edit and mass-email sending access to reference and disclose restricted fields in emails or group auto-replies.

Detection Guidance

Check if your EspoCRM version is 10.0.2 or earlier. If so, the vulnerability may be present. Review email templates for restricted field references and test mass email sending functionality to see if restricted data is exposed.

Impact Analysis

An attacker with template edit and mass-email permissions could access sensitive user data like personal details or internal information. This could lead to data breaches, unauthorized information disclosure, or compliance violations depending on the exposed data.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without authorization and HIPAA by leaking protected health information if such data is stored in restricted fields. Organizations using affected versions may face regulatory penalties for non-compliance.

Mitigation Strategies

Upgrade EspoCRM to version 10.0.3 or later immediately. Ensure ACL is properly configured and restrict email template edit and mass email sending permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77460. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart