EUVD-2026-56149
GHSA-2wg2-5v89-cgh7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low-privilege auth (PR:L); scope unchanged as impact is confined to cross-tenant data within the same application; no availability impact from read, hijack, or delete operations on application continuity.
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content (title, description, and attachments) of tickets belonging to another company, to hijack another company's tickets by reassigning their company_id, and to delete another company's tickets without any authorization check, via the ticket's numeric identifier, because the read and save operations retrieve the record without constraining the query to the authenticated user's company, and the delete controller type-hints a generic Illuminate\Http\Request instead of the TicketDeleteRequest that would enforce the required permission.
AnalysisAI
Cross-tenant IDOR in Roskus Prospero Flow CRM's ticket management component allows any authenticated user - regardless of company affiliation - to read full ticket content (titles, descriptions, attachments), hijack tickets by overwriting their company_id, and delete tickets belonging to any other tenant on the shared instance. The root cause is a missing authorization boundary in three distinct Eloquent query paths that retrieve tickets by numeric ID without scoping results to the authenticated user's company, compounded by the delete controller accepting a generic HTTP request class that bypassed the application's own permission gate entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated user session on the target Prospero Flow CRM instance; any role including low-privilege Support users can exploit the read and hijack vectors (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) accurately captures the threat model: network-accessible, no attack complexity, low-privilege authentication required, high confidentiality and integrity impact, no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Support-role user at Company A logs into a shared Prospero Flow CRM instance and iterates numeric IDs via GET /ticket/update/{id}, reading full ticket content belonging to Company B including customer communications and attachments. The attacker then POSTs to /ticket/save with a modified company_id field to reassign high-value Company B tickets into Company A's namespace, and calls GET /ticket/delete/{id} on remaining tickets to destroy Company B's support history - all without triggering any authorization check, because the delete endpoint accepted any authenticated request regardless of ticket ownership. |
| Remediation | Upgrade to Roskus Prospero Flow CRM v5.5.3 or later, available at https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3, which incorporates fix commit b2b6ffdace0972ab62d1f7e8cdab0ed213bfc4a9. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit ticket access logs and pull a preliminary count of any cross-tenant read/modify/delete events; notify your Roskus support contact and request immediate availability of the patched version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prospero Flow Crm
View allCross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user
Cross-tenant transaction data exposure in Roskus Prospero Flow CRM 5.0.0-5.3.5 allows any authenticated user on a shared
Privilege escalation in Roskus Prospero Flow CRM before version 5.2.1 permits any authenticated user - regardless of ass
Broken function-level authorization in Prospero Flow CRM before 5.5.3 lets any authenticated low-privileged user (e.g. t
Cross-tenant payroll data exposure in Roskus Prospero Flow CRM before 5.15.10 enables authenticated users holding standa
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.4.7 allows any authenticated user to read sensitive product recor
Cross-tenant IDOR in Prospero Flow CRM before 5.4.8 allows any authenticated user to blindly overwrite contact records b
Unauthorized notification deletion in Prospero Flow CRM allows any authenticated user to delete other users' notificatio
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.5.3 allows any authenticated user to read, modify, and delete ord
Cross-tenant record injection in Roskus Prospero Flow CRM before 5.14.0 allows any authenticated user to silently insert
Tenant data boundary failure in Roskus Prospero Flow CRM 4.9.1-5.14.0 allows authenticated users holding transaction and
Stored cross-site scripting in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated Seller-role user to achiev
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today