{"id":"CVE-2026-126305","kind":"vulnerability","aliases":["CVE-2026-126305"],"related":[],"title":"EspoCRM: stored XSS in Knowledge Base lets attacker create admin accounts","description":"EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an administrator clicks the link, the script runs in their session and can create an administrator account with attacker-chosen credentials.","summary":"EspoCRM before 9.3.11 and 10.x before 10.0.9 let a user with Knowledge Base create or edit access store a JavaScript file and a crafted link in an article. When an administrator clicks that link, the script runs in their session and can create a new administrator account with attacker-chosen credentials.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["espocrm","knowledge-base","package","self-hosted"],"not_affected_if":["no-knowledge-base-editors","patched-version"],"how_to_check":"- Check the installed EspoCRM version in the application's version or package files; versions below `9.3.11` on the 9.x line, or below `10.0.9` on the 10.x line, are in range.\n- Review Knowledge Base users who have create or edit access, since they are the ones who can plant the payload.","fix":"- EspoCRM 9.x: upgrade to `9.3.11` or later.\n- EspoCRM 10.x: upgrade to `10.0.9` or later.","status":"open","published_at":"2026-11-13T10:17:35+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","triaged_at":"2026-11-13T10:50:59+00:00","updated_at":"2026-11-13T10:50:59+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:50:59Z","model":"claude-haiku-5-5","output":{"fix":"- EspoCRM 9.x: upgrade to `9.3.11` or later.\n- EspoCRM 10.x: upgrade to `10.0.9` or later.","reach":"network","title":"EspoCRM: stored XSS in Knowledge Base lets attacker create admin accounts","impact":"high","summary":"EspoCRM before 9.3.11 and 10.x before 10.0.9 let a user with Knowledge Base create or edit access store a JavaScript file and a crafted link in an article. When an administrator clicks that link, the script runs in their session and can create a new administrator account with attacker-chosen credentials.","audience":"businesses","category":"package","nicknames":[],"who_cares":["espocrm","self-hosted","knowledge-base"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"script runs as admin and creates an attacker-chosen administrator account","analyst_note":"","how_to_check":"- Check the installed EspoCRM version in the application's version or package files; versions below `9.3.11` on the 9.x line, or below `10.0.9` on the 10.x line, are in range.\n- Review Knowledge Base users who have create or edit access, since they are the ones who can plant the payload.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","no-knowledge-base-editors"],"who_is_affected":"Teams that run a self-hosted EspoCRM instance on a version below 9.3.11 or 10.0.9 and use the Knowledge Base module with users who can create or edit articles. The attack needs an account with Knowledge Base create or edit rights, and an administrator must click the crafted link. Instances on patched versions, or with no Knowledge Base users beyond trusted staff, have lower exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000796,"input_tokens":4637,"output_tokens":664,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126305':14A,17A '-2026':13A,16A '10':30B,83C '10.0.9':33B,86C '9.3.11':28B,81C 'access':43B,108C 'account':11A,73B,139C 'add':114C 'admin':10A 'administr':57B,72B,124C,138C 'articl':54B,98C,120C 'attach':109C 'attack':8A,76B,142C 'attacker-chosen':75B,141C 'base':6A,21B,39B,97C,104C 'bodi':121C 'chosen':77B,143C 'click':58B,125C 'contain':87C 'craft':50B,116C 'creat':9A,40B,69B,105C,136C 'credenti':78B,144C 'cross':91C 'cross-sit':90C 'cve':12A,15A 'edit':42B,107C 'espocrm':1A,18B,26B,79C 'file':47B,112C 'host':25B 'javascript':46B,111C 'knowledg':5A,20B,38B,96C,103C 'knowledge-bas':19B 'let':7A,34B,100C 'link':51B,60B,117C,127C 'new':71B 'packag':22B 'run':63B,130C 'script':62B,93C,129C 'self':24B 'self-host':23B 'session':66B,133C 'site':92C 'store':2A,44B,89C 'user':36B,101C 'vulner':94C 'x':31B,84C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted EspoCRM instance on a version below 9.3.11 or 10.0.9 and use the Knowledge Base module with users who can create or edit articles. The attack needs an account with Knowledge Base create or edit rights, and an administrator must click the crafted link. Instances on patched versions, or with no Knowledge Base users beyond trusted staff, have lower exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["espocrm","high","knowledgebase","package","selfhosted"],"campaign_type":null,"search_a":"'-126305':14A,17A '-2026':13A,16A 'account':11A 'admin':10A 'attack':8A 'base':6A 'creat':9A 'cve':12A,15A 'espocrm':1A 'knowledg':5A 'let':7A 'store':2A 'xss':3A","search_b":"'10':30B '10.0.9':33B '9.3.11':28B 'access':43B 'account':73B 'administr':57B,72B 'articl':54B 'attack':76B 'attacker-chosen':75B 'base':21B,39B 'chosen':77B 'click':58B 'craft':50B 'creat':40B,69B 'credenti':78B 'edit':42B 'espocrm':18B,26B 'file':47B 'host':25B 'javascript':46B 'knowledg':20B,38B 'knowledge-bas':19B 'let':34B 'link':51B,60B 'new':71B 'packag':22B 'run':63B 'script':62B 'self':24B 'self-host':23B 'session':66B 'store':44B 'user':36B 'x':31B","search_c":"'10':83C '10.0.9':86C '9.3.11':81C 'access':108C 'account':139C 'add':114C 'administr':124C,138C 'articl':98C,120C 'attach':109C 'attack':142C 'attacker-chosen':141C 'base':97C,104C 'bodi':121C 'chosen':143C 'click':125C 'contain':87C 'craft':116C 'creat':105C,136C 'credenti':144C 'cross':91C 'cross-sit':90C 'edit':107C 'espocrm':79C 'file':112C 'javascript':111C 'knowledg':96C,103C 'let':100C 'link':117C,127C 'run':130C 'script':93C,129C 'session':133C 'site':92C 'store':89C 'user':101C 'vulner':94C 'x':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T08:44:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126305","severity":null,"published_at":"2026-11-13T10:17:35+00:00","modified_at":"2026-11-13T10:17:35+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","fetched_at":"2026-11-13T10:47:15+00:00","note":null}],"documents":[{"id":144939,"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-j6q5-9jwj-9p8q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T08:44:56+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144940,"url":"https://www.vulncheck.com/advisories/espocrm-before-10.0.9-stored-xss-via-knowledge-base-article-attachments","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}