EspoCRM Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Vulnerability - CVE-2026-92298

EspoCRM through 10.0.8 uses PHPs rand() function to generate tokens for lead-capture opt-in event invitation and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins accept or decline event invitations on behalf of other contacts and access event details.