Medium severity4.3NVD Advisory· Published Oct 13, 2026· Updated Oct 13, 2026

CVE-2026-109958

Description

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the emailAddress field.

Affected products

Espocrm/Espocrmllm-fuzzy
Range: <10.0.7

Patches

Vulnerability mechanics

References

github.com/espocrm/espocrm/security/advisories/GHSA-2cr7-9g4f-8723nvd
www.vulncheck.com/advisories/espocrm-4.0.0-before-10.0.7-field-level-access-bypass-via-address-book-searchnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000