CVE-2020-37094

CRITICAL

9.8

Description

EspoCRM 5.8.5 contains an authentication vulnerability that allows attackers to access other user accounts by manipulating authorization headers. Attackers can decode and modify Basic Authorization and Espo-Authorization tokens to gain unauthorized access to administrative user information and privileges.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published2/3/2026

Last Modified3/3/2026

Sourcenvd

Honeypot Sightings0

Affected Products

espocrm:espocrm

Weaknesses (CWE)

CWE-639

References

https://www.espocrm.com(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/48376(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/espocrm-privilege-escalation(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.