medium4.3
CVE-2026-90934
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read …
Impact
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.
Affected products
| Product | Affected versions |
|---|---|
| EspoCRM | before 10.0.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.