CVE-2026-90934
EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 14, 2026
- Updated
- Sep 14, 2026
- Reserved
- Sep 14, 2026
Description
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
espocrmespocrm |
|
References
- GitHub Security Advisory (GHSA-hpgx-8qg3-5w7v)vendor-advisory
- VulnCheck Advisory: EspoCRM before 10.0.4 Field-level Security Bypass via Attendeesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.