CVE-2026-105833CWE-522

CVE-2026-105833

High · published October 8, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and access the victim's mailbox.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00220 · 11.9th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-10-08T19:17Z
References (2)
https://github.com/espocrm/espocrm/security/advisories/GHSA-pj52-qx2q-4qfp · [email protected]https://www.vulncheck.com/advisories/espocrm-before-10.0.5-idor-via-personalaccount-service-exposes-imap-passwords · [email protected]
EPSS history
Timeline
  • 10 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 08 OCT 14:10Z
    EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
    cvelistv5
  • 08 OCT 14:10Z
    EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
    cvelistv5