CVE-2026-82911

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.

Use of hard-coded credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.

An unrestricted upload of file with dangerous type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission (routine Seller role) to execute arbitrary JavaScript in the application origin. The photo validation rule classifies the file only by its content (magic bytes) and rejects only a fixed list of PHP extensions, while ProductSaveController::save() names the stored file using the client-supplied extension and copies it into the public web root. A file that begins with an image header and carries an HTML extension passes validation, is stored under public/asset/upload/product/, and is served with a text/html content type, turning the upload into first-party stored script execution.

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.

In the payroll module in Roskus Prospero Flow CRM before 5.15.10, an authorization bypass through user-controlled key vulnerability exists. Authenticated users holding the read payroll permission can view salary and banking details of employees of any other company in the instance, and users holding the create payroll permission can create payroll records attributed to another company's employees, because the listing query is not scoped to the caller's company and the employee identifier is validated for global existence rather than company membership.

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7. Authenticated users of any company can read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and hijack that product by reassigning its company_id, via the product's numeric identifier, because ProductUpdateController did not extend MainController and therefore required no authentication check on the read endpoint, and ProductRepository::save() retrieved the record via Product::find($data['id']) without constraining the query to the authenticated user's company before overwriting its company_id.

Roskus Prospero Flow CRM before 5.4.9 has an authorization bypass through user-controlled key, allowing authenticated users of any company to read, hijack, and delete tickets belonging to another company.

Roskus Prospero Flow CRM before version 5.4.8 has an authorization bypass vulnerability in the contact management component, allowing authenticated users to overwrite contact data of other companies and download their personal data as vCard.

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.