CVE-2026-19433
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Roskus Prospero Flow CRM before version 5.4.8 has an authorization bypass vulnerability in the contact management component, allowing authenticated users to overwrite contact data of other companies and download their personal data as vCard.
Risk Assessment
An attacker can access and modify personal data of other companies' contacts, potentially leading to privacy breach and data integrity issues.
Recommendation
Update Roskus Prospero Flow CRM to version 5.4.8 or later, which includes the fix.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact's numeric identifier, because the save and export operations retrieve the record without constraining the query to the authenticated user's company.