CVE-2026-92298

MediumCVSS 4.8/10Last modified Oct 8, 2026

Description

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and access event details.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-338

Affected software

No affected versions have been published.

Timeline

Published: Sep 16, 2026
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-922997.4@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowi CVE-2026-92304.3The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up CVE-2026-92317.5The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versio CVE-2026-92326.5The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via CVE-2026-92334.3The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up CVE-2026-92344.3The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.4.1. This CVE-2026-92354.3The DHL eCommerce (Benelux) for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missin CVE-2026-923558.7In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to CVE-2026-923564.3A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.CVE-2026-923574.3A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the compo CVE-2026-923586.4A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a tem CVE-2026-923593.1A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function create_strands_app of the file integ