MEDIUM 5.3 NVD
CVE-2026-109959
EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level secu
EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/{id}, which skips the NoteAccessControl filter, and recover data.attributes.was and became values of restricted fields.
References
- https://github.com/espocrm/espocrm/security/advisories/GHSA-mr36-xx82-qf6h
- https://www.vulncheck.com/advisories/espocrm-4.0.0-before-10.0.7-field-level-security-bypa
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-13 via NVD.
vulnfeed aggregates 13242 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.