CVE-2026-19734
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7. Authenticated users of any company can read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and hijack that product by reassigning its company_id, via the product's numeric identifier, because ProductUpdateController did not extend MainController and therefore required no authentication check on the read endpoint, and ProductRepository::save() retrieved the record via Product::find($data['id']) without constraining the query to the authenticated user's company before overwriting its company_id.
Risk Assessment
Exposure of sensitive business data (prices, costs, stock levels) and the ability to hijack competitors' products can lead to confidentiality and integrity breaches and financial losses.
Recommendation
Update Roskus Prospero Flow CRM to version 5.4.7 or later, which includes the fix. Additionally, verify that all endpoints require proper authorization and that database queries are scoped to the user's company context.
Original NVD description (English source)
Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and to hijack that product by reassigning its company_id, via the product's numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data['id'])` without constraining the query to the authenticated user's company before overwriting its company_id.