CVE-2026-92298: EspoCRM through 10.0.8 Weak Token Generation via rand()
EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and access event details.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker does not need an EspoCRM account or user interaction. Exploitation requires guessing a token used in a lead-capture opt-in, event invitation, or campaign URL.
Which workflows are exposed?
The affected tokens are used for lead-capture opt-in confirmation, event invitations, and campaign URLs. An attacker who successfully guesses one can confirm an opt-in, accept or decline an event invitation for another contact, or access event details.
How can I determine whether my deployment is affected?
EspoCRM versions through 10.0.8 are identified as using PHP rand() for these tokens. Deployments that use the affected opt-in, invitation, or campaign URL workflows should be treated as exposed.