Description

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T13:19:31.830Z",
  "pubdate": "2026-09-14T13:19:31.830Z",
  "executiveSummary": "EspoCRM versions prior to 10.0.4 are susceptible to a field-level security bypass vulnerability within the meeting and call attendee management endpoints.\nThis vulnerability is classified as an improper authorization flaw, specifically stemming from incorrect Access Control List (ACL) scope validation.\nThe vulnerability allows authenticated users to retrieve sensitive, restricted email addresses associated with meeting or call attendees that should otherwise be shielded from their view.\nThe risk implication is a significant breach of data confidentiality regarding contact information. An attacker possessing valid user credentials can leverage this flaw to enumerate hidden participant details without the necessary administrative or ownership privileges.\nExploitation requires an active session with authenticated access to the application. No further specialized privileges are required to trigger the validation logic failure, as the system incorrectly validates the request against the parent entity rather than the specific attendee record.",
  "technicalDetails": "The root cause of this vulnerability lies in a flaw within the ACL validation logic governing the meeting and call attendee endpoints. In EspoCRM, security scopes are designed to enforce granular field-level permissions. However, the system fails to apply these checks directly to the attendee entity.\nWhen a request is initiated to retrieve attendee data, the underlying API controller performs an authorization check. Instead of evaluating the permissions associated with the attendee record, the system incorrectly verifies the user's access rights against the parent entity (the meeting or call event itself).\nBecause the parent entity may have broader read permissions or looser access restrictions compared to individual attendee records, the system erroneously grants access to data that is intentionally marked as restricted. This discrepancy between the requested object and the evaluated permission scope creates a bypass vector.\nThe attack flow proceeds as follows: 1) An authenticated user performs a GET request to the relevant attendee endpoint. 2) The backend receives the request and initializes the ACL security check. 3) The validation engine maps the request to the parent record permission set rather than the specific attendee object metadata. 4) If the user has read access to the parent meeting or call, the system permits the retrieval of the associated attendee record. 5) The API response includes the restricted email addresses of participants, which the client-side application then renders for the unauthorized user.\nThis vulnerability affects EspoCRM versions prior to 10.0.4. Because the issue is inherent to the server-side API authorization logic, it is accessible to any user authenticated within the application environment. The impact is limited to unauthorized data disclosure; however, in a CRM context, this can lead to the systemic exposure of private contact lists and sensitive organizational relationships.\nThe vulnerability is localized to the attendee management modules. By miscalculating the security context, the application fails to enforce the principle of least privilege, allowing users to pivot from authorized access of an event to unauthorized access of sensitive attendee metadata."
}