CVE-2026-105832 — EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes
EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing…
Published: 2026-10-08 · CVSS: 5.3 · CVSS 4.0
EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7