CVE-2026-77460

EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is disabled. The same behavior affects group email auto-replies when a regular user can edit the selected template, even though an administrator controls the group email. Rendered messages can disclose restricted user fields. This issue is fixed in version 10.0.3.

• CWE-639

• https://github.com/espocrm/espocrm/commit/b3309f8b2060e77b377f672a30358a30b61f3111
• https://github.com/espocrm/espocrm/releases/tag/10.0.3
• https://github.com/espocrm/espocrm/security/advisories/GHSA-28w2-h88g-6vgv

Published

Oct 15, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77438Trilium is an open-source hierarchical note-taking applicati…7.5
• CVE-2026-7744A vulnerability was found in CodeAstro Online Classroom 1.0.…6.3
• CVE-2026-7745A vulnerability was determined in CodeAstro Online Classroom…6.3
• CVE-2026-77454Incorrect Authorization vulnerability in ash-project ash_sql…5.9
• CVE-2026-77459Argo CD is a declarative, GitOps continuous delivery tool fo…9.9
• CVE-2026-7746A vulnerability was identified in SourceCodester Web-based P…6.3
• CVE-2026-77465toml-node is a TOML parser for Node.js and the browser. Prio…7.5
• CVE-2026-77466Lychee is a free, open-source photo-management tool. Prior t…8.3
• CVE-2026-77467Lychee is a free, open-source photo-management tool. Prior t…7.1
• CVE-2026-77468Lychee is a free, open-source photo-management tool. Prior t…6.9
• CVE-2026-7747A security flaw has been discovered in Totolink N300RH 3.2.4…9.8
• CVE-2026-77470Lychee is a free, open-source photo-management tool. Prior t…8.3