EspoCRM versions prior to 10.0.7 suffer from an improper access control flaw that lets authenticated users retrieve email addresses through the address‑book search API even when Role settings normally hide the emailAddress field. This bypass allows an attacker to read sensitive user contact information, constituting a breach of confidentiality consistent with CWE‑200.

This issue affects all deployments of EspoCRM 4.0.0 up to, but not including, 10.0.7. Any installation that has the address‑book search API enabled and uses Role‑based field permissions is potentially vulnerable.

The CVSS score of 5.3 classifies this vulnerability as medium severity. No EPSS score is available, and it is not listed in the CISA KEV catalog. The flaw is exploitable by any authenticated user who has record access to the system; it does not require a remote network attack but can be triggered from the normal user interface or API calls. The attacker can learn otherwise protected email addresses, providing a foothold for phishing or further reconnaissance.