PT-2026-44407 · Espocrm · Espocrm

Yurikuzn · CVE-2026-41141 · Published 2026-05-28 · Updated 2026-05-28

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.5

Description The POST '/api/v1/EmailTemplate/:id/prepare' endpoint accepts an emailAddress parameter and resolves the owning entity (Contact, Lead, Account, or User) without performing an Access Control List (ACL) check. An authenticated user with EmailTemplate read permission can extract all field values of any entity by supplying the target's email address, bypassing read: own or read: team ACL restrictions. ACL is a mechanism used to define which users or system processes are granted access to objects in an environment.

Recommendations Update to version 9.3.5.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-41141

GHSA-VVMH-MF4H-96HW

Affected Products

Espocrm

References · 4

• 🔥 https://github.com/espocrm/espocrm/security/advisories/GHSA-vvmh-mf4h-96hw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41141.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-41141 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41141 · Security Note