CVE-2026-105833
EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in…
- Risk score
- 49/100
- CVSS
- 7.7 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and acces…
- Affected
- See advisory
- Fix
- Upgrade the product to 10.0.5 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.7 high
References
Original description
EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and access the victim's mailbox.
Last activity 8 Oct 2026. Patch Forecast updates every hour.