Vulnerability · Published Oct 15, 2026 · Assigned by GitHub_M

CVE-2026-77460EspoCRM: Mass email template renderer leaks restricted record fields

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in espocrm from espocrm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 86.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is disabled. The same behavior affects group email auto-replies when a regular user can edit the selected template, even though an administrator controls the group email. Rendered messages can disclose restricted user fields. This issue is fixed in version 10.0.3.

Affected products (as reported)

Vendor	Product	Versions
espocrm	espocrm	< 10.0.3

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/espocrm/espocrm/security/advisories/GHSA-28w2-h88g-6vgv x_refsource_CONFIRM
https://github.com/espocrm/espocrm/commit/b3309f8b2060e77b377f672a30358a30b61f3111 x_refsource_MISC
https://github.com/espocrm/espocrm/releases/tag/10.0.3 x_refsource_MISC