CVE-2026-90934 in EspoCRM
Summary
by MITRE • 09/14/2026
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The identified vulnerability within EspoCRM versions prior to 10.0.4 represents a critical flaw in the application's access control logic, specifically affecting the handling of meeting and call attendees endpoints. This issue stems from an incorrect implementation of Access Control List scope validation mechanisms that govern field-level security for sensitive data fields such as email addresses. In secure systems, when accessing related entities or nested resources, the authorization engine must independently verify permissions against each specific entity involved in the operation rather than relying solely on the permissions associated with a parent object. The flaw arises because the application erroneously checks the ACL scope of the parent event record to determine if an authenticated user is permitted to view attendee information. This architectural oversight means that if a user has read access to the meeting or call itself, they are granted implicit permission to view all fields within related entities, including those marked as restricted for other users.
From a technical perspective, this vulnerability allows any authenticated user with at least basic read permissions on an event entity to bypass field-level security restrictions applied to attendee records. The attacker can exploit the meeting and call attendees endpoints by sending crafted HTTP requests that target specific attendee identifiers associated with events they are authorized to view. Because the backend logic fails to validate whether the requesting user has explicit permission to access the email address field of each individual attendee, it returns the full data payload including hidden contact details. This behavior violates the principle of least privilege and demonstrates a failure in implementing proper object-level security checks for related database records. The vulnerability is particularly dangerous because it does not require elevated privileges or administrative rights; standard user accounts can leverage this flaw to harvest sensitive personal information from multiple attendees across various events they have access to view.
The operational impact of this field-level security bypass is significant, primarily concerning data privacy and regulatory compliance. Email addresses are considered personally identifiable information under many global data protection regulations such as the General Data Protection Regulation in Europe or similar frameworks elsewhere. Unauthorized disclosure of these details can lead to severe consequences for both the organization hosting EspoCRM and its users, including reputational damage, legal liability, and potential misuse of harvested contact lists for phishing campaigns or spamming activities. Furthermore, this vulnerability undermines trust in the CRM system's ability to protect sensitive customer data, potentially leading to loss of business opportunities if clients perceive the platform as insecure. The ease of exploitation means that even users with minimal access rights can aggregate large volumes of restricted email addresses by iterating through events they are permitted to view, creating a scalable vector for mass data exfiltration without detection by standard audit logs focused on parent entity access.
To mitigate this vulnerability, organizations running EspoCRM must immediately upgrade to version 10.0.4 or later where the ACL scope validation logic has been corrected to properly check permissions against each attendee entity individually rather than relying on parent event permissions. Until an upgrade is feasible, administrators should review user roles and ensure that access to meeting and call entities is restricted to only those personnel who strictly require it for their job functions. Additionally, implementing network-level controls such as Web Application Firewalls may help detect anomalous patterns of bulk data retrieval from attendee endpoints, although this is not a definitive fix given the legitimate nature of the requests. Security teams should also audit existing user permissions to minimize the number of accounts with broad read access to event records, thereby reducing the attack surface available for exploitation. Regular security assessments and penetration testing focused on object-level authorization flaws are recommended to identify similar misconfigurations in other parts of the application ecosystem.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-284 which describes Improper Access Control where insufficient access control leads to unauthorized information disclosure. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate authenticated credentials to bypass intended security restrictions and exfiltrate data. The nature of the flaw highlights a common pitfall in web application development where developers assume that controlling access at one level automatically secures all related levels without explicit verification for each subordinate resource. Addressing such issues requires rigorous code review processes focused on authorization logic, particularly when dealing with nested or relational data structures within enterprise software solutions like customer relationship management platforms.