CVE-2026-77460

Published: Oct 15, 2026Modified: Oct 15, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is disabled. The same behavior affects group email auto-replies when a regular user can edit the selected template, even though an administrator controls the group email. Rendered messages can disclose restricted user fields. This issue is fixed in version 10.0.3.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (3)

https://github.com/espocrm/espocrm/commit/b3309f8b2060e77b377f672a30358a30b61f3111

Source: security-advisories@github.com

https://github.com/espocrm/espocrm/releases/tag/10.0.3

Source: security-advisories@github.com

https://github.com/espocrm/espocrm/security/advisories/GHSA-28w2-h88g-6vgv

Source: security-advisories@github.com

Timeline

No history available yet.