CVE-2026-59237
MediumCVSS 6.9Summary
The vulnerability allows an authenticated user to bypass authorization by manipulating numeric IDs in REST API endpoints. The Order and OrderItem controllers in Prospero Flow CRM before version 5.5.3 do not verify record ownership by the user's company, enabling reading, modifying, and deleting orders and order items belonging to other tenants.
Risk Assessment
The organization is exposed to unauthorized access to other customers' order data, potentially leading to sensitive information leakage, business data manipulation, and system integrity compromise.
Recommendation
Immediately upgrade Prospero Flow CRM to version 5.5.3 or later, which includes a fix that scopes record access by the authenticated user's company.
Other vulnerabilities in Prospero Flow CRM
See all- CVE-2026-77780Medium
Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 have an authorization bypass vulnerability via user-controlled key in the transaction save endpoint. A user with transaction creation permissions can disclose another company's bank account name, bank name, and card last four digits by providing a foreign `bank_account_id` or `bank_card_id` in POST /transaction/save.
- CVE-2026-77759High
Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 have an authorization bypass through user-controlled key in the transaction API. An authenticated user can read transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, without company scoping or permission check.
- CVE-2026-59236Medium
A vulnerability in Prospero Flow CRM before version 5.14.0 allows an authenticated user to bypass authorization via a user-controlled key (CWE-639) in the Excel import functionality. An attacker can create customer, lead, and product records in another company's tenant by uploading a spreadsheet with a manipulated company_id column.
- CVE-2026-59235High
Missing authorization in BankAccountListController of Prospero Flow CRM below 5.5.3 allows an authenticated attacker with low privileges to read arbitrary bank account records via the API endpoint without proper role checks.
- CVE-2026-59234Medium
A vulnerability in Prospero Flow CRM before version 5.5.3 allows an authenticated attacker to delete arbitrary calendar events of other users by manipulating the {id} parameter in a GET request to /calendar/event/delete/{id}. The lack of ownership check (user_id/company_id) before deletion leads to unauthorized data destruction.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company (tenant) via a sequential numeric {id} supplied to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or DELETE /api/order-item/{id}, because the controllers resolve records with Order::find($id) / Item::find($id) without scoping by the authenticated user's company.