Password Hash Disclosure in EspoCRM Software

CVE-2025-32789

What is CVE-2025-32789?

EspoCRM, an open-source Customer Relationship Management software, has a vulnerability that allows unauthorized access to user password hashes prior to version 9.0.7. Attackers can exploit this flaw by sorting users based on their password hashes, potentially revealing other users' hashed passwords. Although the risk is minimal, an attacker with knowledge of their own password hash can systematically change their password and sort again to expose other users' hashes, compromising account security. This vulnerability has been addressed in version 9.0.7.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References