Prospero Flow CRM CVE-2026-114519

Requires a valid authenticated account with at least a basic role on the installation (PR:L - a JWT accepted by the auth:api middleware); exploitation is not possible without an account. The read path (GET /api/user/{id}, affecting all versions 2.0.0 before 5.26.0) is limited to accounts within the attacker's own company but ignores role/permission, exposing higher-privileged accounts' email, telephone, postal address and IBAN. The delete path (DELETE /api/user/{id}) exists only from version 3.5.0; it is normally scoped to the attacker's own company, but the comparison is skipped when the attacker's account belongs to Company::DEFAULT_COMPANY (company ID 1), in which case deletion of any account in any company - including a company's last administrator - is possible. No user interaction and no non-default configuration are needed beyond holding a basic-role account; the limiting factors are the required authentication and, for cross-company deletion, membership in the default company.

Signals point to a genuine but authentication-gated priority rather than an internet-wide emergency. The CVSS 4.0 score of 8.6 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H reflects an easily reached network API where a low-privileged (PR:L) authenticated user obtains high confidentiality and high integrity impact. The vuln.today Decision label is 'this_week', consistent with a serious access-control flaw that is not under active mass exploitation. No CISA KEV listing is present, so there is no confirmed active exploitation; no EPSS score was provided, so exploitation probability cannot be quantified from the input; and no public exploit reference is supplied - only the vendor fix commit and the secur0.com CNA advisory. The PR:L requirement is the main limiting factor: an attacker must already hold a valid JWT for a basic-role account on the installation, so the realistic threat is a malicious or compromised low-privilege tenant user, not an anonymous remote attacker. One data inconsistency: the input Tags label this 'Authentication Bypass', but the CWE (CWE-862 Missing Authorization) and the requirement for a valid JWT make it a broken-authorization/privilege-escalation issue, not an authentication bypass - authentication succeeds, authorization is simply never checked. Overall this is a real must-patch issue for operators of this CRM, but the absence of KEV/EPSS/PoC signals and the PR:L precondition argue against treating it as a drop-everything emergency.

A user holding only a basic role on a Prospero Flow CRM installation authenticates to obtain a valid API JWT, then directly calls GET /api/user/{id} to read other users' accounts in their own company - including higher-privileged administrators - harvesting email addresses, phone numbers, postal addresses and IBANs. On versions 3.5.0 and later the same user calls DELETE /api/user/{id} to remove accounts, and if their account belongs to Company::DEFAULT_COMPANY (company ID 1) the company-scoping check is skipped, letting them delete any account in any company of the installation, including the last administrator of a company. No public exploit code is referenced; only the vendor patch commit and CNA advisory are available.