A critical authentication vulnerability in EspoCRM 5.8.5 allows unauthenticated attackers to hijack user accounts and escalate privileges to administrative levels.

This vulnerability involves the improper handling of Basic Authorization and Espo-Authorization tokens. Attackers can decode and modify these headers to bypass authentication mechanisms and impersonate other users, including administrators.

The ability for an attacker to gain unauthorized administrative access poses a severe threat to data integrity, confidentiality, and system availability. Given the CVSS score of 9.8, this vulnerability could lead to total system compromise, theft of sensitive customer data, and unauthorized modification of business records.

Immediate Action: Upgrade to the latest available version of EspoCRM provided by the vendor to remediate the header manipulation flaw.

Proactive Monitoring: Review application access logs for anomalous authorization header patterns or unauthorized access attempts to administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and validate authorization headers for malformed or suspicious token strings.

Public Exploit Available: Unknown

This vulnerability represents a critical security risk that requires immediate attention. Organizations utilizing EspoCRM 5.8.5 should prioritize patching to the latest version to prevent unauthorized administrative access and potential data exfiltration.