Espocrm vulnerabilities
43 CVEs and advisories name Espocrm as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-118686EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex
- CVE-2026-75505EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment
- CVE-2026-77460EspoCRM: Mass email template renderer leaks restricted record fields
- CVE-2026-63130EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.json` file read, write and delete
- CVE-2026-59994EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received
- CVE-2026-55154EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export
- CVE-2026-55184EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled
- CVE-2026-53575EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user
- CVE-2026-53574EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
- CVE-2026-46691EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users
- CVE-2026-46708EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record
- CVE-2026-47168EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params
- CVE-2026-46694EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes
- CVE-2026-109959EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint
- CVE-2026-109958EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search
- CVE-2026-109957EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter
- CVE-2026-105833EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
- CVE-2026-105832EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes
- CVE-2026-105831EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form
- CVE-2026-92298EspoCRM through 10.0.8 Weak Token Generation via rand()
- CVE-2026-90934EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
- CVE-2026-88896EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass
- CVE-2026-41141EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup
- CVE-2026-41160EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes
- CVE-2026-33741EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript
- CVE-2026-33733EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete
- CVE-2026-33656EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user
- CVE-2026-33740EspoCRM: Email importEml can import and delete another user's attachment by raw fileId
- CVE-2026-33659EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access
- CVE-2026-33657EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field