EspoCRM versions through 10.0.8 use PHP's non-cryptographically secure rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs. This weak token generation allows remote unauthenticated attackers to guess tokens, potentially confirming opt-ins, accepting or declining event invitations on behalf of other contacts, and accessing event details. The vulnerability has a medium severity with a CVSS score of 4.8.