Which versions of Espocrm are affected by CVE-2020-37094?

EspoCRM 5.8.5 contains a high-severity privilege escalation vulnerability (CVSS 8.6) that allows attackers to manipulate authentication tokens to assume administrator privileges, bypassing access…

Is there a public PoC exploit available for CVE-2020-37094?

Yes, a public proof-of-concept exploit is available for CVE-2020-37094. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2020-37094?

Within 24 hours: Identify all EspoCRM 5.8.5 and earlier installations; restrict network access to trusted networks/VPN only. Within 7 days: Audit administrator account activities and low-privilege user accounts for suspicious token usage; enable detailed audit logging for authentication events. Within 30 days: Apply vendor patch upon release; if unavailable, upgrade to the latest EspoCRM version or implement vendor-recommended mitigations.

Espocrm CVE-2020-37094

Q: What is the CVSS score of CVE-2020-37094?

CVE-2020-37094 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-02-03 disclosure@vulncheck.com

Authentication Bypass Espocrm

8.6

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-reachable but needs a valid low-priv account (PR:L) and the same-password token-reuse precondition (AC:H); yields full account/admin data read and modify (C:H/I:H), no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 10, 2026 - 15:34 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 10, 2026 - 15:32 vuln.today

Analysis Updated

Jul 10, 2026 - 15:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 10, 2026 - 15:22 vuln.today

cvss_changed

Severity Changed

Jul 10, 2026 - 15:22 NVD

CRITICAL HIGH

CVSS changed

Jul 10, 2026 - 15:22 NVD

9.8 (CRITICAL) 8.6 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Mar 03, 2026 - 14:59 vuln.today

Public exploit code

CVE Published

Feb 03, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionCVE.org

EspoCRM 5.8.5 contains an authentication vulnerability that allows attackers to access other user accounts by manipulating authorization headers. Attackers can decode and modify Basic Authorization and Espo-Authorization tokens to gain unauthorized access to administrative user information and privileges.

AnalysisAI

Authorization bypass in EspoCRM 5.8.5 lets an authenticated low-privilege user reuse or manipulate Basic-Authorization and Espo-Authorization tokens to authenticate as a different user, including administrators, and inherit their privileges. The flaw stems from the login path never binding an auth token to its owning user, so a token valid for one account is accepted for another when passwords collide, also defeating two-factor authentication. Publicly available exploit code exists (Exploit-DB 48376); EPSS is low at 0.35%, and the issue is not listed in CISA KEV.