CVE-2026-78365
CriticalCVSS 9.3Summary
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.
Risk Assessment
The risk includes unauthorized access to other companies' supplier data, potential modification or takeover, potentially leading to confidentiality, integrity, and availability breaches in the CRM system.
Recommendation
It is recommended to immediately update Roskus Prospero Flow CRM to a version newer than 5.3.1 that includes a fix for this vulnerability, and to implement access controls based on record ownership.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.