CVE-2026-90934: EspoCRM Field-Level Security Bypass

CVE-2026-90934 Overview

CVE-2026-90934 is a field-level security bypass vulnerability affecting EspoCRM versions before 10.0.4. The flaw resides in the meeting and call attendees endpoints, where incorrect Access Control List (ACL) scope validation checks parent event permissions instead of attendee entity permissions. Authenticated users can exploit this weakness to read restricted email addresses that should remain hidden by field-level security controls. The vulnerability is categorized under [CWE-863: Incorrect Authorization] and requires only low-privileged authenticated access over the network.

Critical Impact
Authenticated attackers can enumerate protected attendee email addresses across meetings and calls, exposing sensitive contact data that violates configured field-level access restrictions.

Affected Products

EspoCRM versions prior to 10.0.4
EspoCRM meeting attendees endpoint
EspoCRM call attendees endpoint

Discovery Timeline

2026-09-14 - CVE CVE-2026-90934 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90934

Vulnerability Analysis

The vulnerability stems from incorrect authorization logic in EspoCRM's attendees endpoints. When a client requests attendee data for a Meeting or Call entity, the application validates the caller's permissions against the parent event record rather than the attendee record itself. This mismatch bypasses field-level security rules that restrict visibility of sensitive attendee attributes such as email addresses. Any user who holds read access to a meeting or call can therefore retrieve attendee email addresses even when explicit ACL rules forbid access to those fields on the underlying user or contact records.

The issue falls under CWE-863 (Incorrect Authorization). It reflects a scope-confusion defect: the ACL engine enforces permissions on the wrong entity type, so field-level restrictions never execute against the returned attendee objects.

Root Cause

The root cause is an authorization check anchored to the wrong entity scope. EspoCRM's ACL manager evaluates access using the parent Meeting or Call scope, then returns nested attendee data without re-validating field-level ACLs on the attendee entities. Fields marked as restricted through the field-level security model are consequently serialized in the response.

Attack Vector

Exploitation requires an authenticated session with any account permitted to view a meeting or call record. The attacker issues authenticated API requests to the attendees endpoints and parses the response for restricted fields. No user interaction, elevated privileges, or specialized tooling is needed. No verified public exploit code has been published. See the VulnCheck Advisory on EspoCRM Bypass and the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-90934

Indicators of Compromise

Repeated authenticated API requests to /api/v1/Meeting/*/attendees or /api/v1/Call/*/attendees endpoints from a single account
Response payloads containing emailAddress fields for attendees the requesting account is not authorized to view
Unusual enumeration patterns iterating sequential meeting or call identifiers

Detection Strategies

Review EspoCRM application logs for high-volume attendee endpoint access originating from non-administrative accounts
Compare accessed attendee email fields against the requesting user's configured field-level ACL scope
Correlate attendee endpoint requests with subsequent outbound email or phishing activity targeting exposed addresses

Monitoring Recommendations

Enable verbose API access logging on the EspoCRM instance and forward logs to a centralized SIEM
Alert on authenticated users retrieving attendee data at rates exceeding normal business usage
Track account-level access baselines to identify credential misuse consistent with data harvesting

How to Mitigate CVE-2026-90934

Immediate Actions Required

Upgrade EspoCRM to version 10.0.4 or later, which corrects the ACL scope evaluation on attendee endpoints
Audit recent access to meeting and call attendee endpoints and identify accounts that queried restricted fields
Rotate or revoke API keys and session tokens for accounts suspected of abusing the endpoint

Patch Information

EspoCRM addressed the vulnerability in release 10.0.4. Review the GitHub Security Advisory GHSA-hpgx-8qg3-5w7v for patch commit references and upgrade instructions. Administrators should test the upgrade in a staging environment before deploying to production.

Workarounds

Restrict access to the attendees endpoints through a reverse proxy or web application firewall rule until patching is complete
Limit meeting and call read permissions to trusted roles to reduce the population of accounts capable of exploiting the flaw
Disable or remove unused low-privilege accounts to shrink the authenticated attack surface

bash

# Configuration example: upgrade EspoCRM to the patched release
cd /var/www/espocrm
php command.php upgrade --to=10.0.4
php command.php rebuild