CVE-2026-92298 — EspoCRM through 10.0.8 Weak Token Generation via rand()
EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator…
Published: 2026-09-16 · CVSS: 6.3 · CVSS 4.0
EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and access event details.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7