CVE-2026-105832 Details
Description
EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly.
A vulnerability in EspoCRM versions prior to 10.0.6 allows authentication bypass on routes that do not require authentication. This issue enables attackers to skip the second factor of two-factor authentication (2FA) by exploiting knowledge of a 2FA-enabled user's username and password. As a result, attackers can access certain configuration parameters that are not publicly exposed.
Users can upgrade to EspoCRM version 10.0.6 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EspoCRM | <= 10.0.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | New CVE Received | [email protected] |
| Oct 8, 2026 | CVE Modified | CISA-ADP |