Executive brief
EspoCRM is an open-source customer relationship management (CRM) platform used by businesses to manage customer data, leads, and sales processes. A security flaw in the email template system allows an authorized user to bypass privacy restrictions and view sensitive information belonging to other people or companies. By providing a target's email address, an attacker can extract personal details, internal notes, and contact information they are not supposed to see, potentially leading to a significant data breach of the CRM's contents.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the `EmailTemplate` preparation endpoint of EspoCRM. The root cause is located in `Espo\Tools\EmailTemplate\Processor::prepare()`, which fails to perform Access Control List (ACL) checks when resolving entities via the `emailAddress` parameter, unlike the `parentId` path which is properly secured. An authenticated attacker with basic `EmailTemplate` read permissions can craft a template with placeholder variables and call the `/api/v1/EmailTemplate/:id/prepare` endpoint. By supplying a victim's email address, the server populates the template with the victim's full attribute set (including Contacts, Leads, Accounts, or Users) and returns the data in the API response. This allows for the unauthorized extraction of sensitive fields, bypassing 'read: own' or 'read: team' restrictions. The issue is resolved in version 9.3.5.
Affected products
- EspoCRM EspoCRM < 9.3.5
Timeline
- 2026-05-08: advisory: GitHub Security Advisory published
- 2026-05-28: disclosed: NVD publication date