CVE-2026-109959: EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint
EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/{id}, which skips the NoteAccessControl filter, and recover data.attributes.was and became values of restricted fields.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 10.0.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user needs stream access to the parent record associated with an audited note. The issue exposes historical values of fields that would otherwise be restricted by field-level security.
What access and request are required to retrieve restricted values?
The attacker must know or obtain an individual note ID and send a GET request to /Note/{id}. That endpoint bypasses the NoteAccessControl filter and can return data.attributes.was and became values for restricted audited fields.
Are current field values exposed, or only historical data?
The exposed data is the audited prior and changed values recorded in stream notes, represented by the was and became attributes. The provided information does not establish exposure of the current field value through this endpoint.
Which versions are affected?
EspoCRM versions from 4.0.0 before 10.0.7 are affected. Upgrading to 10.0.7 or later addresses the affected version range.