CVE-2026-109958 Overview
CVE-2026-109958 is an improper access control vulnerability in EspoCRM, an open-source customer relationship management (CRM) platform. The flaw affects versions 4.0.0 through versions prior to 10.0.7. Authenticated users can bypass field-level role restrictions on the emailAddress field by querying the address-book search Application Programming Interface (API). The vulnerability is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].
Critical Impact
Authenticated EspoCRM users with record access can retrieve restricted email addresses through the address-book search endpoint, bypassing Role configurations that would otherwise hide the emailAddress field.
Affected Products
- EspoCRM versions 4.0.0 through 10.0.6
- EspoCRM address-book search API
- Deployments relying on Role-based field-level access control for emailAddress
Discovery Timeline
- 2026-10-13 - CVE-2026-109958 published to the National Vulnerability Database (NVD)
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-109958
Vulnerability Analysis
EspoCRM enforces access control through Roles that can restrict visibility of specific entity fields, including emailAddress. The address-book search API returns contact candidates for lookup and auto-complete workflows. This endpoint fails to honor the field-level Role restrictions applied to the emailAddress field.
As a result, an authenticated user who holds record-level access to a target entity can issue address-book search queries and receive email address values. The user would otherwise be denied visibility of those values through standard record views. The vulnerability is categorized under [CWE-200] information disclosure.
Root Cause
The root cause is incomplete enforcement of field-level Access Control Lists (ACLs) within the address-book search handler. Record-level permissions are applied, but field-level permissions on emailAddress are not evaluated when the handler serializes response data. This produces an authorization gap between the standard record read path and the address-book search path.
Attack Vector
Exploitation requires network reachability to the EspoCRM web interface and valid authenticated credentials with low privileges. An attacker queries the address-book search API with search terms targeting users or contacts. The response contains the restricted emailAddress values for matching records.
Successful exploitation yields email addresses that can be used for phishing, enumeration, or linking identities across data sets. See the GitHub Security Advisory GHSA-2cr7-9g4f-8723 and the VulnCheck Advisory for EspoCRM for additional technical context. No public proof-of-concept exploit code is available.
Detection Methods for CVE-2026-109958
Indicators of Compromise
- Unexpected volume of requests to the address-book search API endpoint from a single authenticated session
- Address-book search queries issued by accounts that do not normally perform contact lookup operations
- Response payloads from the address-book search endpoint containing emailAddress values for users or contacts outside the account's business scope
Detection Strategies
- Review EspoCRM application logs for repeated address-book search API calls correlated with low-privilege user sessions
- Compare field-level Role configurations against observed API responses to identify discrepancies in emailAddress visibility
- Baseline normal address-book search behavior per user role and alert on statistical deviations
Monitoring Recommendations
- Forward EspoCRM web server and application logs to a central Security Information and Event Management (SIEM) platform for correlation
- Enable audit logging for address-book search endpoint access and retain logs for incident review
- Monitor outbound email patterns for signs of phishing campaigns that may leverage harvested addresses
How to Mitigate CVE-2026-109958
Immediate Actions Required
- Upgrade EspoCRM to version 10.0.7 or later, which contains the fix for CVE-2026-109958
- Audit active user accounts and revoke credentials that are no longer required
- Review Role configurations to confirm emailAddress restrictions are intentional and documented
Patch Information
The vendor has released EspoCRM 10.0.7 with corrected field-level access control enforcement for the address-book search API. Refer to the GitHub Security Advisory GHSA-2cr7-9g4f-8723 for official remediation guidance and release notes.
Workarounds
- Restrict network access to the EspoCRM instance using Virtual Private Network (VPN) or IP allowlisting until patching is complete
- Reduce the number of accounts with record access to entities containing sensitive emailAddress values
- Disable or limit integrations and client applications that rely on the address-book search API where feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
