CVE-2026-105833GHSA-pj52-qx2q-4qfp
EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
espocrm espocrm
CVSS
8.3HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 10.0.5espocrmCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and access the victim's mailbox.
Text from CVE List
Affected versions 2
- espocrmaffected: all versions before 10.0.5CVE List
- espocrmunaffected: 10.0.5CVE List