The vulnerability lies in the EmailTemplate prepare endpoint, which accepts an email address and resolves the owning entity (Contact, Lead, Account, or User) without enforcing ACL checks. A user with only EmailTemplate read permission can provide any valid email address and retrieve all field values of the corresponding entity, bypassing read‑own and read‑team restrictions. This leads to data exposure of sensitive customer and internal information.

EspoCRM versions prior to 9.3.5 are affected; the issue is fixed in 9.3.5 and later. The product is the open‑source EspoCRM engine.

With a CVSS score of 6.5 the vulnerability is considered moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request to the /api/v1/EmailTemplate/:id/prepare endpoint; it requires an authenticated session but does not need elevated privileges. Once authenticated, an attacker can harvest arbitrary entity data by supplying any known email address.