{"id":"CVE-2026-105833","published":"2026-10-08T15:17:35.913","lastModified":"2026-10-08T18:17:15.000","description":"EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and access the victim's mailbox.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-522"],"vendors":[],"products":[],"references":[{"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-pj52-qx2q-4qfp","tags":[]},{"url":"https://www.vulncheck.com/advisories/espocrm-before-10.0.5-idor-via-personalaccount-service-exposes-imap-passwords","tags":[]}],"exploitRefs":[{"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-pj52-qx2q-4qfp","tags":[]}],"hasPoc":true,"ai":{"summary":"EspoCRM before 10.0.5 has an insecure direct object reference vulnerability that allows users with Email Account scope access to retrieve other users' IMAP passwords by knowing a victim's Email Account record ID. This means attackers can steal stored IMAP credentials and gain access to victim mailboxes.","exploitability":"Exploitation is relatively straightforward requiring only knowledge of a target user's Email Account record ID, with no additional authentication needed beyond existing Email Account scope access.","blast_radius":"The vulnerability could impact multiple users' email accounts simultaneously if attackers discover valid Email Account record IDs through enumeration or other means, potentially leading to widespread mailbox access and data exposure.","remediation":"Upgrade to EspoCRM 10.0.5 or later to address this insecure direct object reference vulnerability.","detection":"Monitor for unauthorized API requests to the PersonalAccount\\Service endpoint that access Email Account records without proper authorization, particularly looking for requests with Email Account record IDs that don't belong to the requesting user.","tags":["web","auth","data-exfiltration"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:23:05.194Z"}}