CVE-2026-77460: EspoCRM Information Disclosure Vulnerability

CVE-2026-77460 Overview

EspoCRM, an open source customer relationship management (CRM) application, contains an authorization flaw in its email template renderer prior to version 10.0.3. A user with email-template edit access and mass-email sending permissions can reference restricted record fields inside a template. The renderer stops filtering those fields when per-user Access Control List (ACL) application is disabled. The same behavior affects group email auto-replies when a regular user can edit the selected template, even when an administrator controls the group email. Rendered messages can disclose restricted user fields to recipients.

Critical Impact
Authenticated low-privilege users can exfiltrate restricted record fields by embedding them in email templates processed with ACL filtering disabled.

Affected Products

EspoCRM versions prior to 10.0.3
EspoCRM Mass Email module
EspoCRM Group Email auto-reply functionality

Discovery Timeline

2026-10-15 - CVE CVE-2026-77460 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-77460

Vulnerability Analysis

The vulnerability is an authorization bypass classified as [CWE-639] Authorization Bypass Through User-Controlled Key. EspoCRM's template rendering pipeline relies on per-user ACL enforcement to strip restricted fields from rendered output. When mass-email sending invokes the template processor with withApplyAcl(false), the renderer treats the operation as privileged and emits every referenced field, including fields the template author cannot read directly through the UI or API.

An authenticated user with mass-email privileges can craft a template that references restricted fields on targeted user records. The processor renders those fields into the outgoing email body. The same code path handles group email auto-replies, so a regular user who can edit a selected template can force disclosure through replies dispatched under an administrator-owned group email.

Root Cause

The root cause is the unconditional disabling of ACL application in the mass email sending processor. The pre-patch call withApplyAcl(false) instructed the template engine to skip permission checks on referenced fields, assuming the sending context had legitimate access to all data. The engine did not re-evaluate whether the template author had authored unauthorized field references.

Attack Vector

Exploitation requires an authenticated account with email-template edit access plus either mass-email sending access or edit access to a template used by a group email auto-reply. The attacker inserts Handlebars-style field references for restricted attributes into a template, then triggers mass send or an inbound email that fires the auto-reply. Rendered output is delivered to recipients controlled by the attacker.

php

// Patch excerpt: application/Espo/Modules/Crm/Tools/MassEmail/SendingProcessor.php
$emailData = $this->templateProcessor->process(
    $emailTemplate,
    TemplateParams::create()
-        ->withApplyAcl(false) // @todo Revise.
+        ->withApplyAcl(false) // Has access to all fields.
        ->withCopyAttachments(false), // @todo Revise.
    TemplateData::create()
        ->withParent($target)

Source: GitHub Commit b3309f8

The companion change to application/Espo/Core/Htmlizer/Htmlizer.php imports Espo\Core\AclManager so the htmlizer can perform field-level permission checks against the template author rather than relying on the caller's ACL flag.

Detection Methods for CVE-2026-77460

Indicators of Compromise

Outbound emails sent from EspoCRM containing user record fields that are not normally exposed in templates, such as internal identifiers, password hashes, API keys, or private contact attributes.
Email templates authored by non-administrative users that reference fields outside the author's standard ACL scope.
Unusual mass email campaigns or group email auto-replies initiated by accounts with newly granted template edit rights.

Detection Strategies

Audit the email_template table for Handlebars placeholders referencing restricted field names on User, Account, or custom entities.
Correlate MassEmail and EmailQueueItem records with the authoring user's ACL profile to flag templates referencing fields the author cannot read directly.
Review web server access logs for POST requests to /api/v1/EmailTemplate and /api/v1/MassEmail from low-privilege accounts.

Monitoring Recommendations

Enable EspoCRM audit logging for template create, update, and send actions, and forward logs to a centralized SIEM.
Alert on any role modification that grants edit on EmailTemplate combined with create on MassEmail for non-administrator users.
Monitor outbound SMTP volume from the CRM host for spikes that align with template edits by non-admin accounts.

How to Mitigate CVE-2026-77460

Immediate Actions Required

Upgrade EspoCRM to version 10.0.3 or later, which enforces field-level ACL checks in the template renderer.
Revoke mass-email and template edit permissions from non-administrative roles until the upgrade is applied.
Review all existing email templates for references to restricted fields and remove unauthorized placeholders.

Patch Information

The fix is delivered in EspoCRM 10.0.3. See the GitHub Release 10.0.3, the GitHub Security Advisory GHSA-28w2-h88g-6vgv, and the security commit b3309f8. The patch introduces AclManager into Htmlizer.php so field access is validated against the template author rather than relying on the caller to disable ACL enforcement.

Workarounds

Restrict EmailTemplate edit permissions to administrators until patching is complete.
Reassign group email auto-reply templates so they can only be edited by administrator roles.
Disable the mass email module in roles granted to standard users if the upgrade cannot be deployed immediately.

bash

# Verify installed EspoCRM version and upgrade
php -r "echo json_decode(file_get_contents('application/Espo/Resources/defaults/config.php'), true);"
cd /path/to/espocrm
php command.php upgrade --version=10.0.3
php clear_cache.php