Is CVE-2026-41141 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41141 being exploited in the wild.

How severe is CVE-2026-41141?

Medium severity, with a CVSS score of 6.5, published 28 May 2026.

Is there a fix for CVE-2026-41141?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-41141 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-41141?

Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41141: EspoCRM IDOR in EmailTemplate endpoint leaks entity data

CVE-2026-41141 · Severity: medium · CVSS 6.5 · Published 2026-05-28

EspoCRM is an open-source customer relationship management (CRM) platform used by businesses to manage customer data, leads, and sales processes. A security flaw in the email template system allows an authorized user to bypass privacy restrictions and view sensitive information belonging to other people or companies. By providing a target's email address, an attacker can extract personal details, internal notes, and contact information they are not supposed to see, potentially leading to a significant data breach of the CRM's contents.

Technologies: Espocrm. Vendors: Espocrm.

Quick answers

Is CVE-2026-41141 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41141 being exploited in the wild.
How severe is CVE-2026-41141?: Medium severity, with a CVSS score of 6.5, published 28 May 2026.
Which products and versions are affected?: Espocrm < 9.3.5.
Is there a fix for CVE-2026-41141?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41141 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41141?: Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the `EmailTemplate` preparation endpoint of EspoCRM. The root cause is located in `Espo\Tools\EmailTemplate\Processor::prepare()`, which fails to perform Access Control List (ACL) checks when resolving entities via the `emailAddress` parameter, unlike the `parentId` path which is properly secured. An authenticated attacker with basic `EmailTemplate` read permissions can craft a template with placeholder variables and call the `/api/v1/EmailTemplate/:id/prepare` endpoint. By supplying a victim's email address, the server populates the template with the victim's full attribute set (including Contacts, Leads, Accounts, or Users) and returns the data in the API response. This allows for the unauthorized extraction of sensitive fields, bypassing 'read: own' or 'read: team' restrictions. The issue is resolved in version 9.3.5.

Affected products

EspoCRM EspoCRM < 9.3.5

Timeline

2026-05-08: advisory: GitHub Security Advisory published
2026-05-28: disclosed: NVD publication date

References

https://github.com/espocrm/espocrm/security/advisories/GHSA-vvmh-mf4h-96hw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.