CVE-2026-105833
EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
CVSS Score
7.7
EPSS Score
0.0%
EPSS Percentile
0th
EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and access the victim's mailbox.
| CWE | CWE-522 |
| Vendor | espocrm |
| Product | espocrm |
| Published | Oct 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for espocrm espocrm
Be the first to know when new high vulnerabilities affecting espocrm espocrm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
espocrm / espocrm
0 < 10.0.5
References
Credits
🔍 skeletonsec