Prospero Flow CRM CVE-2026-19734

Exploitation requires only a valid authenticated session for any user account in any tenant of the Prospero Flow CRM instance - no administrative role, elevated permission, or special configuration is needed. The read-endpoint vulnerability (broken MainController inheritance on ProductUpdateController) means even a newly registered low-privilege user can GET /product/update/{id} for arbitrary IDs without being redirected or rejected. The write/hijack path additionally requires the attacker to supply the target product's numeric ID, which is predictable given Laravel Eloquent's sequential auto-increment primary keys. Multi-tenant deployment is the prerequisite for cross-company impact; single-tenant deployments face intra-organization unauthorized product modification only. No non-default feature flag, specific platform version, or special network position is required beyond a standard Prospero Flow CRM installation running any version before 5.4.7.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) is internally consistent with the description: network-reachable, low complexity, authenticated (PR:L), and yielding high confidentiality and integrity impact with no availability consequence. The PR:L rating means any user holding a valid session in any tenant can exploit both attack paths with no elevation required. No EPSS score was provided in the input data, and the CVE is absent from CISA KEV, so mass automated exploitation is not confirmed - however, the trivially low exploit complexity (sequential integer ID guessing against a predictable auto-increment primary key) and the severe cross-tenant data leakage and asset-hijacking outcome mean real-world risk is disproportionately higher than raw EPSS absence would suggest. For any operator running Prospero Flow CRM in a multi-tenant configuration, this should be treated as a high-priority remediation regardless of KEV status. No conflicting signals exist between the CVSS vector and the technical description - both consistently describe an authenticated low-privilege network attacker requiring no special conditions.

An authenticated user in Company B sends GET requests to /product/update/{id} with sequentially enumerated numeric IDs, reading price, cost, stock quantity, SKU, and barcode fields belonging to Company A's product catalog without any additional privileges. The same user then POSTs to /product/save with the target product's id and their own company_id, silently transferring ownership of Company A's product record into Company B's inventory. No public proof-of-concept code has been identified, but the attack is straightforward given the code-level root cause disclosed in the public commit diff.