Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| espocrm | espocrm | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 13 Oct 2026 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/{id}, which skips the NoteAccessControl filter, and recover data.attributes.was and became values of restricted fields. | |
| Title | EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint | |
| First Time appeared |
Espocrm
Espocrm espocrm |
|
| Weaknesses | CWE-200 | |
| CPEs | cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Espocrm
Espocrm espocrm |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-13T13:27:22.182Z
Reserved: 2026-10-13T11:26:13.464Z
Link: CVE-2026-109959
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor