CVE-2026-55184 espocrm CVE debrief

Who should care

Defenders managing EspoCRM instances, especially those with user-edited templates, should assess exposure and ensure proper CSP configurations to prevent session hijacking. This includes administrators, security teams, and IT personnel responsible for maintaining EspoCRM deployments. They should verify if their instances are vulnerable, review template usage, and implement necessary security measures to protect against potential attacks.

Why it matters

CVE-2026-55184 is a stored XSS vulnerability in EspoCRM that allows crafted HTML payloads to be executed in user sessions when CSP is disabled, potentially leading to session hijacking. Defenders should verify exposure, especially for instances with user-edited templates, and ensure proper CSP configurations.

• Potential session hijacking for users with access to edited templates.
• Bypassing of moderate HTML sanitization.
• Execution of crafted HTML payloads in user sessions.
• Verification of CSP configurations and template usage required.

Technical summary

A user with Email Template or PDF Template edit permission in EspoCRM can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode with clientCspDisabled true, the stored payload executes, potentially hijacking the user's session. This issue is fixed in version 9.3.9. The vulnerability is due to inadequate sanitization of user-supplied HTML, allowing for the injection of malicious scripts that can be executed in the context of another user's session. Defenders should prioritize verifying exposure of EspoCRM instances, especially those with user-edited templates, and ensure proper CSP configurations.

Defensive priority

Defenders should prioritize verifying exposure of EspoCRM instances, especially those with user-edited templates, and ensure proper CSP configurations.

Recommended defensive actions

• Verify EspoCRM instances for exposure, especially those with user-edited templates.
• Ensure Content Security Policy (CSP) is properly configured.
• Update to version 9.3.9 or later.
• Monitor template usage and user access for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fix in version 9.3.9. However, there is limited information on actual exploitation or affected deployments. Defenders should verify exposure, especially for instances with user-edited templates, and ensure proper CSP configurations. The vulnerability is confirmed to exist in versions prior to 9.3.9, but specific details about exploitation are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.