CVE-2026-105832: EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes
EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 10.0.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the username and password of an account with two-factor authentication enabled. No second-factor code or user interaction is required.
What access can an attacker obtain through the bypass?
The bypass applies to routes that do not require authentication and can allow reading configuration parameters that are not publicly exposed. The provided information does not indicate access to authenticated application functionality or the ability to modify data.
Which deployments are affected?
EspoCRM versions before 10.0.6 are affected. Deployments using 2FA-enabled accounts are exposed when an attacker has valid credentials for such an account.
How can I determine whether my instance is vulnerable?
Check the installed EspoCRM version. Instances running a version earlier than 10.0.6 should be considered affected based on the provided information.