# CVE-2026-90934: EspoCRM field-level security bypass in attendees endpoints

Source: https://junglewise.ai/threats/cve-2026-90934-espocrm-field-level-security-bypass-in-attendees-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90934 · Severity: medium · CVSS 4.3 · Published 2026-09-14

EspoCRM is a popular customer relationship management platform that helps businesses manage contacts, leads, meetings, and calls. A security flaw in the meeting and call attendee endpoints allows authenticated users to bypass email address restrictions and view hidden attendee email addresses that they should not have access to. This could expose sensitive contact information to users with limited permissions.

Technologies: [Espocrm](https://junglewise.ai/threats/technologies/espocrm). Vendors: [Espocrm](https://junglewise.ai/threats/vendors/espocrm).

## Quick answers

**Is CVE-2026-90934 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90934 being exploited in the wild.

**How severe is CVE-2026-90934?** Medium severity, with a CVSS score of 4.3, published 14 September 2026.

**Which products and versions are affected?** Espocrm before 10.0.4.

**Is there a fix for CVE-2026-90934?** A patch was published on 2026-10-04: Fixed in version 10.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90934 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90934?** Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-863) in EspoCRM's meeting and call attendees helper endpoints. The flaw occurs because the ACL scope validation checks permissions against the parent Meeting or Call entity rather than the attendee entity (Contact, Lead, or User). An authenticated attacker can access restricted email addresses for attendees by exploiting this incorrect authorization check, even when explicitly denied access to those fields on the attendee record. The vulnerability affects EspoCRM versions before 10.0.4, which included the fix. No patch bypass or exploitation in the wild has been reported.

## Affected products

- EspoCRM EspoCRM before 10.0.4

## Timeline

- 2026-08-29: disclosed
- 2026-09-14: advisory
- 2026-10-04: patched: Fixed in version 10.0.4

## References

- [https://github.com/espocrm/espocrm/security/advisories/GHSA-hpgx-8qg3-5w7v](https://github.com/espocrm/espocrm/security/advisories/GHSA-hpgx-8qg3-5w7v)
- [https://www.vulncheck.com/advisories/espocrm-before-10.0.4-field-level-security-bypass-via-attendees](https://www.vulncheck.com/advisories/espocrm-before-10.0.4-field-level-security-bypass-via-attendees)

## Related threats

- [EspoCRM denial of service in password-redaction regex](https://junglewise.ai/threats/cve-2026-118686-espocrm-before-9-3-11-and-10-x-before-10-0-8-contains-a-denial)
- [EspoCRM authorization bypass in PDF image rendering](https://junglewise.ai/threats/cve-2026-113643-a-vulnerability-was-found-in-espocrm-up-to-9-3-10-10-0-10-this)
- [EspoCRM mass-update attachment access control bypass](https://junglewise.ai/threats/cve-2026-75505-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM HTML injection in email notifications](https://junglewise.ai/threats/cve-2026-59994-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM CSV/XLSX formula injection via whitespace bypass](https://junglewise.ai/threats/cve-2026-55154-espocrm-is-an-open-source-customer-relationship-management)