CVE-2026-105833

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 10.0.5

Description An insecure direct object reference (IDOR) occurs in the PersonalAccountService service. This issue allows users with Email Account scope access to retrieve IMAP passwords belonging to other users. An attacker who possesses a victim's Email Account record ID can request that specific record to steal stored IMAP credentials and gain unauthorized access to the victim's mailbox.

Recommendations Update to version 10.0.5 or later.