CVE-2026-105833: EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-08
Weakness: CWE-522

Description

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and access the victim's mailbox.

Affected products

espocrm: before 10.0.5 — fixed in 10.0.5

How to fix

Upgrade to a fixed version: espocrm 10.0.5. Check the vendor advisory for mitigations.

References

https://github.com/espocrm/espocrm/security/advisories/GHSA-pj52-qx2q-4qfp
https://www.vulncheck.com/advisories/espocrm-before-10.0.5-idor-via-personalaccount-service-exposes-imap-passwords

Get alerted when CVE-2026-105833 or the next vulnerability affects your stack