CVE-2026-105833: EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and access the victim's mailbox.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who has access to the Email Account scope can exploit the issue. The attacker also needs to know another user's Email Account record ID.
What can an attacker obtain?
The attacker can retrieve the stored IMAP password associated with another user's Email Account record. Those credentials can then be used to access the victim's mailbox.
Which versions are affected?
EspoCRM versions before 10.0.5 are affected. Updating to 10.0.5 or later addresses the affected version range described here.
How can I determine whether exposure is possible in my environment?
Check whether the EspoCRM deployment is older than 10.0.5 and whether users are granted Email Account scope access. Users meeting that permission requirement could retrieve another user's account if they know its Email Account record ID.