CVE-2026-92298
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and access event details.
Risk Assessment
An attacker can impersonate other users, manipulate consents, and access event information, potentially leading to confidentiality and integrity breaches. The vulnerability is easily exploitable remotely without authentication.
Recommendation
Update EspoCRM to a version later than 10.0.8 that uses a cryptographically secure token generator. Until then, restrict access to token-generating functions.
Other vulnerabilities in EspoCRM
See all- CVE-2014-7985High
Directory traversal vulnerability in EspoCRM before version 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter to install/index.php.
- CVE-2026-90934Medium
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.
- CVE-2026-88896Medium
EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: (IPv4-mapped IPv6) prefixes but does not recognize IPv6 transition addresses that embed private IPv4 addresses: NAT64 (64:ff9b::), 6to4 (2002::), and Teredo (2001:0000::). An attacker who controls a domain with AAAA records pointing to such transition addresses can bypass both the internal-host validation and the CURLOPT_RESOLVE IP-pinning check, causing EspoCRM to issue outbound requests to internal network services.
- CVE-2026-33741Medium
EspoCRM versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents, resulting in stored cross-user XSS. Although inline SVG script is blocked by CSP, same-origin external script is allowed, so an attacker can upload a malicious SVG together with a second attacker-controlled JavaScript attachment and trick another user into opening the SVG to execute JavaScript.
- CVE-2020-37094High
A vulnerability in EspoCRM 5.7.0 through 5.9.0 allows authenticated attackers to bypass two-factor authentication by reusing authentication tokens bound to password hashes. This enables token replay against any victim account sharing the same password.
Original NVD description (English source)
EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and access event details.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS