CVE-2026-59994

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.9

Description An unauthenticated remote attacker can send an email to a monitored group or IMAP address, such as an email-to-Case address, containing arbitrary HTML within the plain-text body. The application stores this body and renders it without escaping in Email Received stream notification emails sent to users following the related record. This leads to HTML injection and potential JavaScript execution in mail clients that execute such code. This occurs because sanitization processes used for Post and Mention notifications did not cover this specific notification path.

Recommendations Update to version 9.3.9.