CVE-2026-90934: EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 10.0.4 - Upgrade
Upgrade
EspoCRM (meeting/call attendees endpoints)to a version that resolves this vulnerability.Fixed in 10.0.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated EspoCRM user with access to the affected meeting or call attendee endpoints can exploit it. The attacker does not need user interaction, but must have privileges sufficient to access the parent event.
What information can be exposed?
The issue allows recovery of attendee email addresses that are hidden by field-level security restrictions. The provided information describes confidentiality impact only; it does not indicate modification or availability impact.
What versions are affected?
EspoCRM versions before 10.0.4 are affected. Updating to 10.0.4 or later addresses the stated affected-version range.
How can administrators assess exposure?
Review whether users who can access meetings or calls are restricted from viewing attendee email fields through field-level security. If so, those users may still be able to retrieve the hidden addresses through the attendee endpoints on affected versions.