# CVE-2026-92298: EspoCRM weak random token generation for opt-in and invitations

Source: https://junglewise.ai/threats/cve-2026-92298-espocrm-weak-random-token-generation-for-opt-in-and-invitations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92298 · Severity: medium · CVSS 4.8 · Published 2026-09-16

EspoCRM is an open-source customer relationship management platform used by businesses to manage leads, contacts, and events. The application uses PHP's non-cryptographic rand() function to generate tokens for email opt-ins, event invitations, and campaign links. An unauthenticated attacker can guess these roughly 31-bit tokens to confirm opt-ins, accept/decline invitations on behalf of other contacts, and access event details, potentially disrupting business processes and customer relationships.

Technologies: [Espocrm](https://junglewise.ai/threats/technologies/espocrm). Vendors: [Espocrm](https://junglewise.ai/threats/vendors/espocrm).

## Quick answers

**Is CVE-2026-92298 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92298 being exploited in the wild.

**How severe is CVE-2026-92298?** Medium severity, with a CVSS score of 4.8, published 16 September 2026.

**Which products and versions are affected?** Espocrm through 10.0.8.

**Is there a fix for CVE-2026-92298?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92298 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92298?** Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from the use of PHP's rand() function (CWE-330, CWE-338) to generate security tokens in application/Espo/Core/Utils/Util.php:585-590 instead of a cryptographically secure random generator. The tokens provide only ~31 bits of entropy (~2 billion possibilities), making them feasible to brute force. Token verification endpoints return different HTTP responses (500 vs 404) for valid vs invalid tokens, creating an oracle that enables efficient brute-force attacks. No rate limiting is implemented on token verification. An unauthenticated remote attacker can exploit this to guess tokens and perform unauthorized actions including confirming opt-ins, accepting/declining event invitations on behalf of other contacts, and accessing event details. EspoCRM versions through 10.0.8 are affected.

## Affected products

- EspoCRM EspoCRM through 10.0.8

## Timeline

- 2026-09-16: disclosed

## References

- [https://gist.github.com/kazisabu/9e3109aab24245fde19b88f53f965e93](https://gist.github.com/kazisabu/9e3109aab24245fde19b88f53f965e93)
- [https://github.com/espocrm/espocrm](https://github.com/espocrm/espocrm)

## Related threats

- [EspoCRM denial of service in password-redaction regex](https://junglewise.ai/threats/cve-2026-118686-espocrm-before-9-3-11-and-10-x-before-10-0-8-contains-a-denial)
- [EspoCRM authorization bypass in PDF image rendering](https://junglewise.ai/threats/cve-2026-113643-a-vulnerability-was-found-in-espocrm-up-to-9-3-10-10-0-10-this)
- [EspoCRM mass-update attachment access control bypass](https://junglewise.ai/threats/cve-2026-75505-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM HTML injection in email notifications](https://junglewise.ai/threats/cve-2026-59994-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM CSV/XLSX formula injection via whitespace bypass](https://junglewise.ai/threats/cve-2026-55154-espocrm-is-an-open-source-customer-relationship-management)