CVE-2026-59236
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability in Prospero Flow CRM before version 5.14.0 allows an authenticated user to bypass authorization via a user-controlled key (CWE-639) in the Excel import functionality. An attacker can create customer, lead, and product records in another company's tenant by uploading a spreadsheet with a manipulated company_id column.
Risk Assessment
The risk involves potential breach of data isolation between tenants in the CRM system, leading to unauthorized data access, manipulation, and possible financial and reputational damage.
Recommendation
Immediately upgrade Prospero Flow CRM to version 5.14.0 or later, which includes a fix for this vulnerability. As a temporary workaround, disable the Excel import feature for all users until the update is applied.
Other vulnerabilities in Prospero Flow CRM
See all- CVE-2026-77780Medium
Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 have an authorization bypass vulnerability via user-controlled key in the transaction save endpoint. A user with transaction creation permissions can disclose another company's bank account name, bank name, and card last four digits by providing a foreign `bank_account_id` or `bank_card_id` in POST /transaction/save.
- CVE-2026-77759High
Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 have an authorization bypass through user-controlled key in the transaction API. An authenticated user can read transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, without company scoping or permission check.
- CVE-2026-59237Medium
The vulnerability allows an authenticated user to bypass authorization by manipulating numeric IDs in REST API endpoints. The Order and OrderItem controllers in Prospero Flow CRM before version 5.5.3 do not verify record ownership by the user's company, enabling reading, modifying, and deleting orders and order items belonging to other tenants.
- CVE-2026-59235High
Missing authorization in BankAccountListController of Prospero Flow CRM below 5.5.3 allows an authenticated attacker with low privileges to read arbitrary bank account records via the API endpoint without proper role checks.
- CVE-2026-59234Medium
A vulnerability in Prospero Flow CRM before version 5.5.3 allows an authenticated attacker to delete arbitrary calendar events of other users by manipulating the {id} parameter in a GET request to /calendar/event/delete/{id}. The lack of ownership check (user_id/company_id) before deletion leads to unauthorized data destruction.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company's tenant via a spreadsheet whose company_id column points to the victim tenant, uploaded to POST /customer/import/excel/save, which maps company_id directly from the file and performs no check that it matches the authenticated user's company.