Espocrm
Espocrm Security Releases - October 2026
espocrm-2026-10 Oct 1, 2026 Source: Vendor
Espocrm security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-109957
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3
CVE-2026-109957
BR2026-0000-028295
espocrm
unclaimed
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign att...
Credited as kaizhi888
CVE-2026-109958
BR2026-0000-028296
espocrm
unclaimed
EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with reco...
Credited as d3do-23
CVE-2026-109959
BR2026-0000-028297
espocrm
unclaimed
EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream no...
Credited as d3do-23