Espocrm
CVE-2020-37094
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 10, 2026
Authorization bypass in EspoCRM 5.8.5 lets an authenticated low-privilege user reuse or manipulate Basic-Authorization and Espo-Authorization tokens to authenticate as a different user, including administrators, and inherit their privileges. The flaw stems from the login path never binding an auth token to its owning user, so a token valid for one account is accepted for another when passwords collide, also defeating two-factor authentication. Publicly available exploit code exists (Exploit-DB 48376); EPSS is low at 0.35%, and the issue is not listed in CISA KEV.
Earlier versions of this analysis (2)
Account takeover and privilege escalation in EspoCRM 5.8.5 lets an authenticated low-privilege user impersonate other accounts - including administrators - by tampering with the Basic Authorization and Espo-Authorization header tokens. The root cause, confirmed by the upstream fix commit, is that an issued auth token was accepted without verifying it belonged to the requesting user, enabling token reuse across accounts (notably ones sharing identical passwords). Publicly available exploit code exists (Exploit-DB 48376); the vulnerability is not listed in CISA KEV and its EPSS probability is low (0.35%).
IDOR in EspoCRM session handling enables cross-account access.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Espocrm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable but needs a valid low-priv account (PR:L) and the same-password token-reuse precondition (AC:H); yields full account/admin data read and modify (C:H/I:H), no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
EspoCRM 5.8.5 contains an authentication vulnerability that allows attackers to access other user accounts by manipulating authorization headers. Attackers can decode and modify Basic Authorization and Espo-Authorization tokens to gain unauthorized access to administrative user information and privileges.
Executive ViewAI
EspoCRM 5.8.5 contains a high-severity privilege escalation vulnerability (CVSS 8.6) that allows attackers to manipulate authentication tokens to assume administrator privileges, bypassing access controls and two-factor authentication. Publicly available exploit code exists with no vendor patch available, creating immediate risk for organizations using this version to experience unauthorized administrative access and complete data compromise.
Within 24 hours: Identify all EspoCRM 5.8.5 and earlier installations; restrict network access to trusted networks/VPN only. Within 7 days: Audit administrator account activities and low-privilege user accounts for suspicious token usage; enable detailed audit logging for authentication events. Within 30 days: Apply vendor patch upon release; if unavailable, upgrade to the latest EspoCRM version or implement vendor-recommended mitigations.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict EspoCRM network access to trusted IP ranges via firewall or VPN; (2) Implement comprehensive authentication and authorization audit logging; (3) Enforce unique, strong passwords to prevent collisions; (4) Require re-authentication for sensitive operations to disable token reuse; (5) Monitor for anomalous login patterns and unexpected privilege escalations; (6) Review and minimize low-privilege user account creation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local
Path traversal in EspoCRM's formula scripting engine allows authenticated administrators to achieve arbitrary file read/
PHP object deserialization in EspoCRM versions prior to 9.3.7 lets an authenticated administrator achieve remote code ex
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any ext
EspoCRM 5.6.4 is vulnerable to user password hash enumeration. Rated high severity (CVSS 8.8), this vulnerability is rem
EspoCRM deployments before 10.0.5 allow an authenticated user with Email Account scope to retrieve other users' stored I
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating
Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to i
Path traversal in EspoCRM admin template management allows authenticated administrators to read, create, overwrite, or d
Server-side request forgery in EspoCRM before 10.0.4 allows authenticated users to route outbound HTTP requests to inter
Stored cross-site scripting in EspoCRM 9.3.3 and below enables an authenticated attacker to execute arbitrary JavaScript
Information disclosure in EspoCRM's portal Note API allows an authenticated portal user (CVSS PR:L) who already has stre