Threats affecting pkg:github/espocrm/espocrm

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 contain a denial of service vulnerability due to a CPU-intensive password-redaction regular expression in API error handling. Unauthenticated remote attackers can exploit this by sending a few large API requests concurrently, exhausting server resources and causing service slowdowns or unavailability.

CVE-2026-113643 is an authorization bypass vulnerability in EspoCRM affecting versions 9.3.0 through 9.3.10 and 10.0.0 through 10.0.8. The flaw exists in the ImageSourceProvider::get function within the PDF Rendering Pipeline component, where manipulation of the argument ID can bypass authorization checks. The vulnerability can be exploited remotely. A patch identified by commit 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2 is available to address this issue.

EspoCRM versions through 10.0.8 use PHP's non-cryptographically secure rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs. This weak token generation allows remote unauthenticated attackers to guess tokens, potentially confirming opt-ins, accepting or declining event invitations on behalf of other contacts, and accessing event details. The vulnerability has a medium severity with a CVSS score of 4.8.