CVE-2026-90934CWE-863broken-access-control

CVE-2026-90934

Medium · published September 14, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-14T17:19Z
References (2)
https://github.com/espocrm/espocrm/security/advisories/GHSA-hpgx-8qg3-5w7v · [email protected]https://www.vulncheck.com/advisories/espocrm-before-10.0.4-field-level-security-bypass-via-attendees · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 12:48Z
    EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
    cvelistv5