CVE-2026-109959GHSA-mr36-xx82-qf6h
EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint
espocrm espocrm
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 10.0.7espocrmCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/{id}, which skips the NoteAccessControl filter, and recover data.attributes.was and became values of restricted fields.
Text from CVE List
Affected versions 2
- espocrmaffected: 4.0.0 before 10.0.7CVE List
- espocrmunaffected: 10.0.7CVE List