Prospero Flow CRM CVE-2026-19433

The attacker must hold a valid authenticated session in any company tenant on the shared Prospero Flow CRM installation (CVSS PR:L confirmed). No elevated privileges, no administrative role, and no special configuration are required - standard user-level access to the contact management UI is sufficient. The vulnerability is present in default installations of any version before 5.4.8. Exploitation is limited to instances where multiple companies share the same CRM deployment; single-company self-hosted instances have no cross-tenant data to exfiltrate or corrupt, but the code flaw still exists. The only practical limiting factor is possession of a valid login credential to any tenant account on the target instance.

The CVSS 4.0 base score of 8.6 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H reflects the reality accurately: exploitation is low-complexity and requires only a valid application login, achievable by any of potentially hundreds of tenant users in a shared instance. The dual impact - confidentiality breach via vCard export and integrity breach via blind overwrite - is severe in a CRM context where contacts represent business-critical personal and commercial data. No EPSS score was provided in the intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed mass or targeted exploitation at time of analysis. However, the exploitability is trivially automatable by sequentially incrementing the contact ID integer across the full save and export endpoints, making the potential for opportunistic abuse high in any multi-tenant deployment. The absence of a public exploit from Secur0's advisory lowers immediate risk slightly, but the attack primitive requires no tooling beyond a browser or curl.

An attacker authenticates to Prospero Flow CRM with a legitimate account belonging to their own company, then iterates integer values in POST requests to /contact/save or GET requests to /contact/export-vcard/{id}. Within seconds they can overwrite a competitor's contact records with arbitrary data or download personal contact information (name, email, phone) as vCard files for any contact stored in the shared instance. No exploit toolkit is required - standard HTTP requests with sequential ID values are sufficient.