If you believe you have discovered a vulnerability in EspoCRM, please contact us via this or this forms. Or create a private vulnerability report on GitHub.

What reports we do not accept:

• Executing PHP code by an extension, during extension installation or upgrade process.
• Exposing contacts through a target list, campaign or mass email, considering the user has access to them.
• SSRF in IMAP/SMTP with TOCTOU.

For severe vulnerabilities we provide fixes for 2 minor versions (the second number in the version string) back from the current stable version.