CVE-2026-109959 espocrm CVE debrief

Who should care

Defenders responsible for EspoCRM instances, especially those using versions 4.0.0 before 10.0.7, should assess exposure and prioritize remediation to prevent potential unauthorized access to restricted field values.

Why it matters

CVE-2026-109959 is a medium-severity vulnerability in EspoCRM that allows authenticated users to bypass field-level security and read restricted field values. Defenders should prioritize verifying exposure, assessing impact, and applying patches or updates to prevent potential unauthorized access.

• Potential unauthorized access to restricted field values.
• Bypass of field-level security controls.
• Possible data exposure for users with stream access to parent records.
• Verification of access controls and stream permissions is necessary.

Technical summary

The vulnerability allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/{id}, which skips the NoteAccessControl filter, and recover data.attributes.was and became values of restricted fields. This occurs because the Note read endpoint does not properly enforce field-level security controls, potentially exposing restricted field values to unauthorized users with stream access to parent records.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially if they use EspoCRM versions 4.0.0 before 10.0.7.

Recommended defensive actions

• Verify if the EspoCRM instance is running a vulnerable version (4.0.0 before 10.0.7) and assess the potential impact on the system.
• Review and update access controls to ensure that stream access is properly restricted.
• Monitor system logs for potential exploitation attempts.
• Apply the patch or upgrade to a fixed version (10.0.7 or later) as recommended by the vendor.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories. The vulnerability allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/{id}, which skips the NoteAccessControl filter, and recover data.attributes.was and became values of restricted fields. Evidence is limited to public CVE details and may not be

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.