CVE-2026-92298— EspoCRM through 10.0.8 Weak Token Generation via rand()
Quick assessment
Affected
EspoCRM EspoCRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
EspoCRM 在 10.0.8 及之前版本中使用 PHP 的 函数生成用于线索捕获订阅确认、活动邀请以及营销活动链接的令牌，而非采用密码学安全的随机数生成器。未经身份验证的远程攻击者可以猜测这些约 31 位的令牌，从而确认订阅、代表其他联系人接受或拒绝活动邀请，并访问活动详情。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92298
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
EspoCRM through 10.0.8 Weak Token Generation via rand()
Source: CVE Program / CVE List V5
Vulnerability Description
EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and access event details.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用具有密码学弱点缺陷的PRNG
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92298
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92298
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-92298 (1)
Other References for CVE-2026-92298 (4)
-
-
🔗 EspoCRM Security Vulnerabilities for CVE Assignment · GitHub Read full article technical-description
-
-
🔗 EspoCRM through 10.0.8 Weak Token Generation via rand() | Advisories | VulnCheck third-party-advisory
IV. Related Vulnerabilities
Same product: EspoCRM
-
CVE-2026-90934
EspoCRM before 10.0.4 Field-level Security Bypass via Attend -
CVE-2026-88896
EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypas -
CVE-2026-41141
EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity -
CVE-2026-41160
EspoCRM: Broken Access Control / IDOR in Note Pinning API al -
CVE-2026-33741
EspoCRM: Stored XSS via SVG attachment loading same-origin J
Same vendor: EspoCRM
-
CVE-2026-90934
EspoCRM before 10.0.4 Field-level Security Bypass via Attend -
CVE-2026-88896
EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypas -
CVE-2026-41141
EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity -
CVE-2026-41160
EspoCRM: Broken Access Control / IDOR in Note Pinning API al -
CVE-2026-33741
EspoCRM: Stored XSS via SVG attachment loading same-origin J
Same weakness: CWE-338
-
CVE-2026-93868
Cotonti through 1.0.0 Predictable Password Recovery Token vi -
CVE-2026-92749
SafeLine through 9.4.1 Authentication Bypass via Weak Sessio -
CVE-2026-74887
openssl_encrypt before 1.4.0 Insecure Random Import in PQC M -
CVE-2026-74874
openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel S -
CVE-2026-73567
sm-crypto: Predictable SM2 key generation in Node.js: defaul
V. Comments for CVE-2026-92298
No comments yet