PT-2026-111553

CVE-2026-109958

Published

2026-10-13

Updated

2026-10-13

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions EspoCRM versions 4.0.0 through 10.0.6

Description An improper access control issue allows authenticated users to read restricted emailAddress values. This occurs when users with record access query the address-book search API, enabling them to obtain email addresses even if Roles are configured to restrict the emailAddress field.

Recommendations Update to version 10.0.7 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

D3Do-23

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers