CVE-2026-109959: EspoCRM Information Disclosure Vulnerability

CVE-2026-109959 Overview

CVE-2026-109959 is an access control vulnerability in EspoCRM versions 4.0.0 through 10.0.6. The flaw allows authenticated users to read audited field values that should be restricted by field-level security. Attackers abuse the GET /Note/{id} endpoint, which fails to apply the NoteAccessControl filter when fetching individual stream notes. As a result, users with stream access to a parent record can recover data.attributes.was and data.attributes.became values of restricted fields. The vulnerability is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated users can bypass EspoCRM field-level security and read historical values of audited fields they were never authorized to view.

Affected Products

EspoCRM 4.0.0 and later releases prior to 10.0.7
EspoCRM self-hosted deployments using stream notes with audited fields
EspoCRM instances with field-level security configured on monitored records

Discovery Timeline

2026-10-13 - CVE CVE-2026-109959 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109959

Vulnerability Analysis

EspoCRM uses stream notes to record changes to audited fields on records such as leads, accounts, and opportunities. Each note captures prior and new values in data.attributes.was and data.attributes.became. The application enforces field-level security through a NoteAccessControl filter that strips restricted attributes when listing notes.

The filter is applied to list endpoints but not to the single-note read endpoint. When a client issues GET /Note/{id} for a specific note identifier, EspoCRM returns the raw note record without redacting restricted fields. Any authenticated user with stream access to the parent record can therefore read values of fields they are not permitted to see directly.

Root Cause

The root cause is inconsistent enforcement of field-level authorization across API handlers. The access control decision was implemented at the collection layer rather than inside the Note entity's attribute read path. The single-record read handler trusted the parent-record stream permission as sufficient, which violates the principle of complete mediation.

Attack Vector

Exploitation requires an authenticated account with stream access to a target record. The attacker enumerates stream note identifiers associated with that record and issues a direct GET /Note/{id} request for each identifier. The response payload includes the was and became attributes of audited fields, exposing historical values of restricted data such as salary figures, pricing, pipeline stages, or custom confidential fields.

No elevated privileges, user interaction, or network path beyond standard application access are required. Full technical details are available in the GitHub Security Advisory GHSA-mr36-xx82-qf6h and the VulnCheck Advisory on EspoCRM Security Bypass.

Detection Methods for CVE-2026-109959

Indicators of Compromise

Elevated volume of GET /Note/{id} requests from a single authenticated session targeting notes tied to records with audited sensitive fields.
Sequential or enumerated note identifier access patterns in web server access logs.
API clients issuing direct note reads without preceding stream list calls, indicating identifier harvesting from another source.

Detection Strategies

Correlate authenticated user sessions against note read volume and alert on users whose read counts deviate from role baselines.
Compare GET /Note/{id} response payloads against the requesting user's field-level permissions to flag unauthorized was or became disclosure.
Review audit logs for note reads that reference fields explicitly restricted to higher-privileged roles.

Monitoring Recommendations

Enable verbose API access logging on the EspoCRM /Note/ route and ship logs to a centralized SIEM for retention and query.
Build dashboards tracking per-user note read velocity and flag outliers for review.
Monitor outbound data transfer sizes from authenticated users with limited field-level permissions.

How to Mitigate CVE-2026-109959

Immediate Actions Required

Upgrade EspoCRM to version 10.0.7 or later, which applies the NoteAccessControl filter to the single-note read handler.
Audit existing user roles and remove unnecessary stream access to records containing restricted fields.
Review access logs since the deployment of EspoCRM 4.0.0 for anomalous GET /Note/{id} activity by non-privileged users.

Patch Information

The maintainers released EspoCRM 10.0.7 with a corrected authorization check in the note read handler. Deployment details and the fix commit are documented in the GitHub Security Advisory GHSA-mr36-xx82-qf6h. Administrators should follow the standard EspoCRM upgrade procedure, including a database backup and post-upgrade schema rebuild.

Workarounds

Restrict stream access on records that contain audited restricted fields until the upgrade is applied.
Place a reverse proxy rule in front of EspoCRM that blocks or logs GET /Note/{id} requests from accounts outside a trusted role group.
Disable field auditing on highly sensitive fields to prevent historical values from being captured in stream notes.

bash

# Example reverse proxy rule (nginx) to log direct note reads for review
location ~ ^/api/v1/Note/[A-Za-z0-9]+$ {
    if ($request_method = GET) {
        access_log /var/log/nginx/espocrm_note_reads.log;
    }
    proxy_pass http://espocrm_backend;
}