CVE-2026-109958— EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search
Quick assessment
Affected
espocrm espocrm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
EspoCRM 4.0.0 至 10.0.7（不含 10.0.7）版本存在一个不正确的访问控制漏洞，允许已认证用户通过地址簿搜索 API 读取受限的电子邮件地址（emailAddress）值。即使角色（Roles）对 emailAddress 字段设置了访问限制，具有记录访问权限的用户仍可通过查询地址簿搜索功能获取该电子邮件地址。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109958
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search
Source: CVE Program / CVE List V5
Vulnerability Description
EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the emailAddress field.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109958
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109958
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109958 (2)
Same Patch Batch · espocrm · 2026-10-13 · 3 CVEs total
| CVE-2026-109957 | 4.3 MEDIUM | EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter |
| CVE-2026-109959 | 4.3 MEDIUM | EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint |
IV. Related Vulnerabilities
Same product: espocrm
-
CVE-2026-75505
EspoCRM: Access control bypass in Mass Update letting regula -
CVE-2026-77460
EspoCRM: Mass email template renderer leaks restricted recor -
CVE-2026-63130
EspoCRM: Admin path traversal in LabelManager (Custom Label -
CVE-2026-59994
EspoCRM: Pre-authentication stored HTML injection in stream -
CVE-2026-55154
EspoCRM: CSV/Formula Injection sanitizer bypass via leading
Same vendor: espocrm
-
CVE-2026-75505
EspoCRM: Access control bypass in Mass Update letting regula -
CVE-2026-77460
EspoCRM: Mass email template renderer leaks restricted recor -
CVE-2026-63130
EspoCRM: Admin path traversal in LabelManager (Custom Label -
CVE-2026-59994
EspoCRM: Pre-authentication stored HTML injection in stream -
CVE-2026-55154
EspoCRM: CSV/Formula Injection sanitizer bypass via leading
Same weakness: CWE-200
-
CVE-2026-19621
Mattermost leaks interactive-message integration secrets to -
CVE-2026-109401
WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) S -
CVE-2026-107646
HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Expos -
CVE-2026-109191
Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive I -
CVE-2026-77711
Jetty HttpClient代理凭据泄露漏洞
V. Comments for CVE-2026-109958
No comments yet