EspoCRM versions up to 10.0.8 generate short, predictable tokens with PHP's rand() instead of a cryptographically secure source. These tokens are used in lead‑capture opt‑in links,. An attacker who can guess a token can confirm opt‑ins, manually accept or decline event invitations on behalf of other contacts, and view event details, effectively bypassing required authorization for those actions.

The vulnerability affects EspoCRM installations running any version through 10.0.8. The code paths that generate the tokens are located in the Util.php and UniqueId.php files in the application folder. No specific sub‑versions are listed beyond the main 10.0.8 release, so any deployment of EspoCRM older than or equal to that version is potentially impacted.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score of less than 1% shows that real world exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is remote, unauthenticated, and requires only the ability to try a handful of 31‑bit token values. If an attacker can discover a access to event‑related functionality without needing to authenticate to the system. The limited token space makes exhaustive guessing feasible, especially for low‑volume events.