High severity · published Oct 8, 2026
CVE-2026-105833
EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
7.7
CVSS
0.2%
EPSS
No
On KEV
Description
EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and access the victim's mailbox.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
espocrm · espocrm
before 10.0.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105833
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105833
vendor-advisory
https://github.com/espocrm/espocrm/security/advisories/GHSA-pj52-qx2q-4qfp
third-party-advisory
https://www.vulncheck.com/advisories/espocrm-before-10.0.5-idor-via-personalaccount-service-exposes-imap-passwords
More from espocrm
9.1
CVE-2026-47168
EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params
9.1
CVE-2026-33656
EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user
8.8
CVE-2022-38843
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server
8.8
CVE-2019-14351
EspoCRM 5.6.4 is vulnerable to user password hash enumeration
8.5
CVE-2025-32390
EspoCRM is a free, open-source customer relationship management platform