CVE-2026-77460: EspoCRM: Mass email template renderer leaks restricted record fields
EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is disabled. The same behavior affects group email auto-replies when a regular user can edit the selected template, even though an administrator controls the group email. Rendered messages can disclose restricted user fields. This issue is fixed in version 10.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 10.0.3
Event History
Frequently Asked Questions
Which users can exploit this issue?
A user needs both email-template edit access and mass-email sending access. For group email auto-replies, a regular user can trigger the issue if they can edit the template selected for the group email.
What data could be disclosed?
Rendered email messages can disclose restricted user fields referenced by an attacker-controlled template. The issue affects rendering when per-user ACL application is disabled.
Are group email auto-replies affected even when an administrator controls the group email?
Yes. The administrator's control of the group email does not prevent the issue if a regular user can edit its selected template.
What version fixes the issue?
Upgrade EspoCRM to version 10.0.3. Versions prior to 10.0.3 are affected.