CVE-2026-90934— EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
Quick assessment
Affected
espocrm espocrm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
EspoCRM 在 10.0.4 版本之前存在一个字段级权限绕过漏洞，位于会议和通话参会者接口中，该漏洞允许已认证的用户读取受限的电子邮件地址。攻击者可通过利用不正确的 ACL 作用域验证逻辑来恢复被隐藏的参会者邮箱——该验证错误地检查了父级活动（事件）的权限，而未针对参会者实体本身进行权限校验。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90934
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
Source: CVE Program / CVE List V5
Vulnerability Description
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-90934
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90934
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-90934 (2)
IV. Related Vulnerabilities
Same product: espocrm
-
CVE-2026-88896
EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypas -
CVE-2026-41141
EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity -
CVE-2026-41160
EspoCRM: Broken Access Control / IDOR in Note Pinning API al -
CVE-2026-33741
EspoCRM: Stored XSS via SVG attachment loading same-origin J -
CVE-2026-33733
EspoCRM has Admin TemplateManager path traversal that allows
Same vendor: espocrm
-
CVE-2026-88896
EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypas -
CVE-2026-41141
EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity -
CVE-2026-41160
EspoCRM: Broken Access Control / IDOR in Note Pinning API al -
CVE-2026-33741
EspoCRM: Stored XSS via SVG attachment loading same-origin J -
CVE-2026-33733
EspoCRM has Admin TemplateManager path traversal that allows
Same weakness: CWE-863
-
CVE-2026-82431
Apache Storm Client: Authorization Bypass When nimbus.groups -
CVE-2026-82432
Apache Storm Nimbus: Blobstore Authorization Bypass via Reba -
CVE-2026-82920
Mattermost ABAC parent policy bypass via policy update endpo -
CVE-2026-73236
Apache Syncope: Cross-Realm authorization bypass in delegate -
CVE-2026-73370
Apache Syncope: Cross-Realm boundaries reconciliation bypass
V. Comments for CVE-2026-90934
No comments yet