EspoCRM versions 4.0.0 through 10.0.6 contain an access control flaw that lets any authenticated user retrieve audited field values that are normally hidden by field‑level security. The vulnerability is triggered by requesting GET /Note/{id} for a stream note that the user can access. Because the NoteAccessControl filtering is bypassed, the response includes the "data.attributes.was" and "data.attributes.become" values of restricted fields, exposing potentially sensitive information to users who should not see it.

The affected product is EspoCRM, maintained by EspoCRM Corporation. Any deployment of EspoCRM with version numbers lower than 10.0.7 is vulnerable, including the 4.0.0 release line and all intermediate releases up to 10.0.6.

The CVSS base score of 5.3 indicates moderate severity. Exploitation requires an authenticated account that has stream access to a parent record; the attacker cannot gain privilege escalation beyond that level. EPSS data is not available, and the vulnerability is not listed in the CISA KeV catalog. The risk is primarily data exposure rather than system compromise.