Executive brief
EspoCRM is a popular customer relationship management platform that helps businesses manage contacts, leads, meetings, and calls. A security flaw in the meeting and call attendee endpoints allows authenticated users to bypass email address restrictions and view hidden attendee email addresses that they should not have access to. This could expose sensitive contact information to users with limited permissions.
Technical details
The vulnerability is an authorization bypass (CWE-863) in EspoCRM's meeting and call attendees helper endpoints. The flaw occurs because the ACL scope validation checks permissions against the parent Meeting or Call entity rather than the attendee entity (Contact, Lead, or User). An authenticated attacker can access restricted email addresses for attendees by exploiting this incorrect authorization check, even when explicitly denied access to those fields on the attendee record. The vulnerability affects EspoCRM versions before 10.0.4, which included the fix. No patch bypass or exploitation in the wild has been reported.
Affected products
- EspoCRM EspoCRM before 10.0.4
Timeline
- 2026-08-29: disclosed
- 2026-09-14: advisory
- 2026-10-04: patched: Fixed in version 10.0.4