EspoCRM versions before 10.0.3 allow a user who can edit email templates and send mass emails to reference restricted record fields inside a template because the renderer stops filtering those fields when per-user ACL is turned off. This oversight enables the generation of messages that include values from restricted or private user data, leading to the disclosure of sensitive information. The vulnerability is classified as an information‑disclosure weakness (CWE‑639).

The affected product is EspoCRM. Versions prior to 10.0.3 are vulnerable to this issue. Administrators should verify the deployed version and plan to upgrade if they are running an affected release.

The CVSS base score of 6.5 indicates a moderate impact on confidentiality. The EPSS score is reported as less than 1 %, implying a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and the attack vector is likely to be internal: a user with both email‑template edit and mass‑email sending permissions can trigger the disclosure by crafting an email template that references protected fields. Admins who limit these permissions or disable mass‑email sending for untrusted accounts mitigate the risk until an update is applied.