CVE-2026-126305 · Package
NO FIX YET · SEE WHAT TO DO
EspoCRM before 9.3.11 and 10.x before 10.0.9 let a user with Knowledge Base create or edit access store a JavaScript file and a crafted link in an article. When an administrator clicks that link, the script runs in their session and can create a new administrator account with attacker-chosen credentials.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run a self-hosted EspoCRM instance on a version below 9.3.11 or 10.0.9 and use the Knowledge Base module with users who can create or edit articles. The attack needs an account with Knowledge Base create or edit rights, and an administrator must click the crafted link. Instances on patched versions, or with no Knowledge Base users beyond trusted staff, have lower exposure.
Not affected if no-knowledge-base-editors, patched-version
Who cares espocrm, knowledge-base, self-hosted
9.3.11 on the 9.x line, or below 10.0.9 on the 10.x line, are in range.9.3.11 or later.10.0.9 or later.EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an administrator clicks the link, the script runs in their session and can create an administrator account with attacker-chosen credentials.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.