SB2026110954 - Multiple vulnerabilities in EspoCRM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110954

SB2026110954 - Multiple vulnerabilities in EspoCRM

Published: November 9, 2026 Updated: November 13, 2026

Security Bulletin ID SB2026110954
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Inefficient regular expression complexity (CVE-ID: CVE-2026-118686)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to make EspoCRM slow or unavailable to legitimate users.

The vulnerability exists due to excessive CPU consumption in the password-redaction regular expression during error handling when specially crafted API requests contain large bodies. An unauthenticated remote attacker can send a small number of these requests concurrently to exhaust available server workers and disrupt service.


2) Cross-site scripting (CVE-ID: CVE-2026-126305)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a low-privileged attacker to create an administrator account with attacker-chosen credentials in EspoCRM.

The vulnerability exists due to improper neutralization of crafted links in Knowledge Base articles, allowing attached JavaScript to execute in an administrator's session when clicked. A low-privileged attacker with create or edit access to the Knowledge Base scope can attach a JavaScript file and link to it in an article body to obtain administrator access.


3) Cross-site request forgery (CVE-ID: CVE-2026-126306)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to elevate their own account to administrator through an administrator's authenticated session.

The vulnerability exists due to unsafe handling of uploaded SVG attachments in EspoCRM, allowing image clicks to submit authenticated POST requests to arbitrary backend endpoints. A low-privileged remote attacker can upload a crafted SVG and trigger privileged actions when an administrator opens it in a separate browser tab and clicks the image.


Remediation

Install update from vendor's website.

References