Is CVE-2026-105832 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-105832?

CVE-2026-105832 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-105832

Description

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly.