CyberRota Analysis
AI-GeneratedEspoCRM versions prior to 10.0.4 are vulnerable to a field-level security bypass that enables authenticated users to access restricted email addresses of meeting and call attendees. This flaw arises from improper access control list (ACL) validation, which incorrectly checks permissions at the parent event level rather than for individual attendees. Organizations using EspoCRM should prioritize patching this vulnerability to protect sensitive user information from potential exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.