EspoCRM: IDOR exposes stored IMAP passwords
Summary
EspoCRM versions before 10.0.5 (and 9.3.11 for the 9.x branch) contain an insecure direct object reference in PersonalAccount\Service. An authenticated user with the Email Account scope can request another user's Email Account record by its ID and retrieve the stored IMAP password. An attacker can then access the victim's mailbox, which goes beyond CRM data. The attacker needs a valid low-privilege account and must know the victim's record ID, which the vendor notes is usually not trivial to obtain.
Affected
- EspoCRM 10.0.0 to 10.0.4 (per GitHub advisory GHSA-pj52-qx2q-4qfp; VulnCheck lists all versions before 10.0.5)
- EspoCRM 9.3.10 and earlier
Fixed in
- EspoCRM 10.0.5
- EspoCRM 9.3.11
Workaround
- No vendor-published workaround known.
- Restrict the Email Account scope to users who need it and review which roles hold it.
- Until patched, rotate IMAP passwords for mailboxes connected to EspoCRM and use app-specific passwords or OAuth where supported.
Exploitation
- Not marked as known exploited in the wild.
- CISA SSVC: exploitation none, not automatable.
- No public proof of concept found in the sources reviewed.
- EPSS 0.0022.
Our recommendation
- Update EspoCRM to 10.0.5 or 9.3.11, or preferably the latest patch release of your branch.
- Review Email Account scope assignments and remove them where not required.
- Rotate IMAP credentials on connected mailboxes, especially on shared or internet-facing instances.
- Review access logs for unusual Email Account record requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-pj52-qx2q-4qfp github.com
- VulnCheck advisory: EspoCRM before 10.0.5 IDOR via PersonalAccount Service www.vulncheck.com
- OSV: CVE-2026-105833 osv.dev
- VulDB: CVE-2026-105833 vuldb.com
- HOL Guard: CVE-2026-105833 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:58.
Original description (NVD)
EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and access the victim's mailbox.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.