CVE-2026-105833

Summary

EspoCRM before 10.0.5 has an insecure direct object reference vulnerability that allows users with Email Account scope access to retrieve other users' IMAP passwords by knowing a victim's Email Account record ID. This means attackers can steal stored IMAP credentials and gain access to victim mailboxes.

Exploitability

Exploitation is relatively straightforward requiring only knowledge of a target user's Email Account record ID, with no additional authentication needed beyond existing Email Account scope access.

Blast radius

The vulnerability could impact multiple users' email accounts simultaneously if attackers discover valid Email Account record IDs through enumeration or other means, potentially leading to widespread mailbox access and data exposure.

Detection

Monitor for unauthorized API requests to the PersonalAccount\Service endpoint that access Email Account records without proper authorization, particularly looking for requests with Email Account record IDs that don't belong to the requesting user.

Prioritized remediation

Upgrade to EspoCRM 10.0.5 or later to address this insecure direct object reference vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.