CVE-2026-105833 Overview
CVE-2026-105833 is an insecure direct object reference (IDOR) vulnerability in EspoCRM versions before 10.0.5. The flaw resides in the PersonalAccount\Service component and allows authenticated users with Email Account scope access to retrieve other users' Internet Message Access Protocol (IMAP) passwords. An attacker who knows a victim's Email Account record identifier can request that record and extract stored IMAP credentials. With those credentials, the attacker can access the victim's mailbox directly, bypassing EspoCRM entirely. The weakness is categorized under [CWE-522: Insufficiently Protected Credentials].
Critical Impact
Authenticated low-privilege users can harvest other users' IMAP passwords and gain full access to their mailboxes outside EspoCRM.
Affected Products
- EspoCRM versions prior to 10.0.5
- PersonalAccount\Service component
- Email Account records containing stored IMAP credentials
Discovery Timeline
- 2026-10-08 - CVE-2026-105833 published to the National Vulnerability Database (NVD)
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2026-105833
Vulnerability Analysis
EspoCRM stores IMAP credentials for user mailboxes in Email Account records so the application can poll mail servers on behalf of users. The PersonalAccount\Service class is responsible for returning these records to authenticated callers. Before version 10.0.5, the service did not verify that the requesting user owned the requested Email Account record. Any user with Email Account scope access could request an arbitrary record identifier and receive the full record, including the stored IMAP password. This exposes credentials to lateral mailbox takeover and downstream phishing or data theft from the compromised mail account.
Root Cause
The root cause is a missing ownership check in PersonalAccount\Service when serving record read requests. The service relied on scope-level authorization (whether the role can access Email Accounts at all) instead of per-record ownership validation. Combined with returning the plaintext-equivalent IMAP password field in the response payload, the design violates the principle of least privilege for stored credentials.
Attack Vector
Exploitation requires an authenticated EspoCRM account with Email Account scope access and knowledge of a target Email Account record ID. Record IDs are commonly exposed through list views, related records, API responses, or predictable enumeration. The attacker issues a standard record read API request against the victim's Email Account ID. The response discloses the IMAP password, which the attacker then uses to authenticate directly to the mail server over IMAP. See the GitHub Security Advisory GHSA-pj52-qx2q-4qfp and the VulnCheck Advisory for EspoCRM for additional technical context.
Detection Methods for CVE-2026-105833
Indicators of Compromise
- Email Account record read API calls where the requesting user ID does not match the record owner.
- Unexpected IMAP authentication events from EspoCRM user mailboxes originating from new IP addresses or user agents.
- Spikes in GET requests to Email Account endpoints by non-administrative accounts.
- Successful IMAP logins immediately following EspoCRM API activity from a different user context.
Detection Strategies
- Audit EspoCRM application logs for Email Account record reads and correlate the authenticated user with the record owner field.
- Alert on any user account retrieving more than one distinct Email Account record within a short time window.
- Monitor mail server IMAP logs for authentications that do not correlate with legitimate user sessions on EspoCRM.
Monitoring Recommendations
- Enable verbose API access logging on EspoCRM and ship logs to a centralized analytics platform for correlation.
- Track IMAP login geolocation and client fingerprints for all mailboxes integrated with EspoCRM.
- Review role and scope assignments to identify accounts with Email Account read access and reduce where possible.
How to Mitigate CVE-2026-105833
Immediate Actions Required
- Upgrade EspoCRM to version 10.0.5 or later without delay.
- Rotate every IMAP password stored in EspoCRM Email Account records after patching.
- Review user roles and remove Email Account scope access from users who do not require it.
- Audit recent Email Account read activity to identify potential credential exposure.
Patch Information
The maintainers resolved the issue in EspoCRM 10.0.5 by enforcing ownership checks in PersonalAccount\Service so only the record owner can retrieve an Email Account record. Apply the official release referenced in the GitHub Security Advisory GHSA-pj52-qx2q-4qfp.
Workarounds
- Restrict the Email Account scope in all user roles to prevent read access by non-administrative accounts until patching is complete.
- Force IMAP password rotation and require application-specific passwords where the mail provider supports them.
- Place EspoCRM behind an authenticating reverse proxy and limit API access to known administrator source addresses while remediation is in progress.
# Configuration example: upgrade EspoCRM to the patched release
cd /var/www/espocrm
php command.php upgrade --to=10.0.5
php command.php clear-cache
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
