Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-90934: EspoCRM allows logged-in users to see hidden attendee emails
CVE-2026-90934 · published 1 month ago
Summary
Versions of EspoCRM earlier than 10.0.4 let signed-in users view email addresses of meeting or call participants that should remain private. This occurs because the system checks the wrong permissions when retrieving attendee details. Upgrade to version 10.0.4 or later, or apply the vendor’s patch, to protect those email addresses.
What to do
- Update espocrm espocrm to version 10.0.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| espocrm | espocrm | < 10.0.4 |
Original advisory text
EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.
References
- https://github.com/espocrm/espocrm/security/advisories/GHSA-hpgx-8qg3-5w7v Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90934... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-90934 Vendor Advisory
- https://www.vulncheck.com/advisories/espocrm-before-10.0.4-field-level-security-... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-863Incorrect Authorization
Timeline
Published14 Sep 2026
Updated30 Oct 2026
First seen14 Sep 2026
Track software like this
Free during beta