Medium severity4.3NVD Advisory· Published Oct 8, 2026· Updated Oct 8, 2026

CVE-2026-105832

Description

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly.

Affected products

Espocrm/Espocrmllm-fuzzy
Range: <10.0.6

Patches

Vulnerability mechanics

References

github.com/espocrm/espocrm/security/advisories/GHSA-ph8v-hvf5-wgp9nvd
www.vulncheck.com/advisories/espocrm-before-10.0.6-two-factor-authentication-bypass-on-unauthenticated-routesnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000