Password Hash Disclosure in EspoCRM Software

CVE-2025-32789

What is CVE-2025-32789?

EspoCRM, an open-source Customer Relationship Management software, has a vulnerability that allows unauthorized access to user password hashes prior to version 9.0.7. Attackers can exploit this flaw by sorting users based on their password hashes, potentially revealing other users' hashed passwords. Although the risk is minimal, an attacker with knowledge of their own password hash can systematically change their password and sort again to expose other users' hashes, compromising account security. This vulnerability has been addressed in version 9.0.7.

References