CVE-2026-92298: EspoCRM: weak PRNG tokens allow opt-in/invite forgery

MEDIUM

Published September 16, 2026

CISO Take

EspoCRM through 10.0.8 generates tokens for lead-capture opt-in, event invitation, and campaign URLs with PHP's rand() instead of a cryptographically secure generator, leaving only about 31 bits of guessable entropy. A remote unauthenticated attacker could guess tokens to confirm opt-ins, accept or decline event invitations for other contacts, and read event details. Risk is low: CVSS is 4.8 with high attack complexity, EPSS is 0.0043 (65th percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC says TRACK. The AI relevance is indirect and limited to a CRM that may feed AI agents or automated marketing workflows, and we found no dependent-package data. Upgrade to a release containing the upstream fix commit (8e5555c), and monitor for bursts of failed or sequential token requests against opt-in and invitation endpoints.

Sources:NVDEPSSATLASVulnCheckGitHub

What is the risk?

Low overall. Exploitation needs no authentication or user interaction, but high attack complexity (brute-forcing or predicting a ~31-bit rand() space) limits practicality. Impact is confined to limited confidentiality and integrity of marketing consent state and event data, with no availability effect. There is no known exploitation, no public exploit, and a low EPSS. The CRM's connection to AI systems is indirect, so AI/ML exposure is minimal.

How does the attack unfold?

Initial Access

Unauthenticated attacker identifies a public EspoCRM opt-in, invitation, or campaign URL that uses a rand()-generated token.

AML.T0049

Token Prediction

Attacker brute-forces or predicts the ~31-bit token space, since PHP rand() is not cryptographically secure.

AML.T0091.000

Exploitation

Valid guessed tokens confirm opt-ins or change RSVP status on behalf of other contacts and expose event details.

Impact

Consent records and event data are falsified or disclosed, which can mislead downstream AI or automation workflows and create compliance exposure.

Initial Access

Unauthenticated attacker identifies a public EspoCRM opt-in, invitation, or campaign URL that uses a rand()-generated token.

AML.T0049

Token Prediction

Attacker brute-forces or predicts the ~31-bit token space, since PHP rand() is not cryptographically secure.

AML.T0091.000

Exploitation

Valid guessed tokens confirm opt-ins or change RSVP status on behalf of other contacts and expose event details.

Impact

Consent records and event data are falsified or disclosed, which can mislead downstream AI or automation workflows and create compliance exposure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
EspoCRM	—	—	No patch

Do you use EspoCRM? You're affected.

How severe is it?

CVSS 3.1

4.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade EspoCRM to a version that includes upstream commit 8e5555c, which replaces rand() with a secure generator. 2) Until patched, rate-limit and WAF-protect the opt-in, invitation, and campaign tracking URLs, and block clients making many sequential token guesses. 3) Review consent and RSVP records created since deployment for anomalies such as confirmations without matching email activity. 4) Where AI agents or automation consume CRM consent data, require independent verification before acting on it. 5) Detect by alerting on high request volumes with varying token parameters and on 404 or invalid-token spikes.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassPrivacy ViolationAgentAPIAML.T0049- Exploit Public-Facing Application AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Respond to identified AI risks and supply chain vulnerabilities

Frequently Asked Questions

What is CVE-2026-92298?

Is CVE-2026-92298 actively exploited?

No confirmed active exploitation of CVE-2026-92298 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-92298?

1) Upgrade EspoCRM to a version that includes upstream commit 8e5555c, which replaces rand() with a secure generator. 2) Until patched, rate-limit and WAF-protect the opt-in, invitation, and campaign tracking URLs, and block clients making many sequential token guesses. 3) Review consent and RSVP records created since deployment for anomalies such as confirmations without matching email activity. 4) Where AI agents or automation consume CRM consent data, require independent verification before acting on it. 5) Detect by alerting on high request volumes with varying token parameters and on 404 or invalid-token spikes.

What systems are affected by CVE-2026-92298?

This vulnerability affects the following AI/ML architecture patterns: CRM-integrated AI agent workflows, marketing automation pipelines, agent frameworks consuming CRM data.

What is the CVSS score for CVE-2026-92298?

CVE-2026-92298 has a CVSS v3.1 base score of 4.8 (MEDIUM). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

CRM-integrated AI agent workflowsmarketing automation pipelinesagent frameworks consuming CRM data

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and access event details.

Exploitation Scenario

An attacker scripts requests against a public EspoCRM opt-in confirmation endpoint, enumerating or predicting tokens from the weak rand() output. Valid guesses confirm opt-ins for contacts who never consented, or accept and decline event invitations for others, exposing event details. A downstream AI-driven marketing or outreach agent then treats the forged consent as legitimate and sends communications, creating compliance exposure.

Weaknesses (CWE)

CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG): The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

[Implementation] Use functions or hardware which use a hardware-based random number generation for all crypto. This is the recommended solution. Use CyptGenRandom on Windows, or hw_rand() on Linux.

Source: MITRE CWE corpus.