CVE-2026-109958: EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search
EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the emailAddress field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 10.0.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated EspoCRM user with access to the relevant records can exploit it. No user interaction is required.
What data can be exposed?
The address-book search API can disclose emailAddress values that are restricted by Roles. The issue affects field-level restrictions on email addresses, not necessarily access to the underlying records.
Which versions are affected?
EspoCRM versions from 4.0.0 through versions before 10.0.7 are affected. Version 10.0.7 is not listed as affected.
How can I determine whether my deployment is exposed?
Check whether the EspoCRM version is earlier than 10.0.7 and whether Roles restrict the emailAddress field for users who retain access to corresponding records. In that situation, those users may be able to retrieve restricted addresses through address-book search.