CVE-2026-109959

Name of the Vulnerable Software and Affected Versions EspoCRM versions 4.0.0 through 10.0.6

Description An access control issue allows authenticated users to read audited field values that are restricted by field-level security. By fetching individual stream notes, a user with stream access to a parent record can request the 'GET /Note/{id}' endpoint. This action bypasses the NoteAccessControl filter, enabling the recovery of data.attributes.was and became values from restricted fields.

Recommendations Update EspoCRM to version 10.0.7 or later.