CVE-2026-77460 Details
Description
EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is disabled. The same behavior affects group email auto-replies when a regular user can edit the selected template, even though an administrator controls the group email. Rendered messages can disclose restricted user fields. This issue is fixed in version 10.0.3.
A vulnerability in EspoCRM's email template processing can lead to unauthorized disclosure of restricted record fields. This issue affects versions through 10.0.2. The vulnerability arises because the template renderer fails to properly filter sensitive fields when per-user access control is disabled. As a result, users with the ability to edit email templates and send mass emails can inadvertently access confidential user information. This flaw also impacts group email auto-replies, where regular users can modify templates despite administrators managing the group emails.
Users can upgrade to EspoCRM version 10.0.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/espocrm/espocrm/commit/b3309f8b2060e77b377f672a30358a30b61f3111 | [email protected] | Source CodeVendor |
| https://github.com/espocrm/espocrm/releases/tag/10.0.3 | [email protected] | Release NotesVendor |
| https://github.com/espocrm/espocrm/security/advisories/GHSA-28w2-h88g-6vgv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EspoCRM | <= 10.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |