EUVD-2026-57924
GHSA-xrvm-rxhf-gwgp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible IDOR requiring only a valid session (PR:L); low complexity via sequential ID enumeration; high confidentiality and integrity impact; no availability impact; scope unchanged as attack stays within the same application component.
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and to hijack that product by reassigning its company_id, via the product's numeric identifier, because ProductUpdateController did not extend MainController and therefore required no authentication check on the read endpoint, and ProductRepository::save() retrieved the record via Product::find($data['id']) without constraining the query to the authenticated user's company before overwriting its company_id.
AnalysisAI
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.4.7 allows any authenticated user to read sensitive product records belonging to other tenant companies and reassign those products into their own account. Two compounding root causes drive the impact: ProductUpdateController lacked the MainController inheritance that enforces session-based authorization, leaving the product read endpoint unguarded, while ProductRepository::save() performed a bare Product::find($data['id']) lookup with no company_id scope constraint, enabling cross-tenant record hijacking. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only a valid authenticated session for any user account in any tenant of the Prospero Flow CRM instance - no administrative role, elevated permission, or special configuration is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) is internally consistent with the description: network-reachable, low complexity, authenticated (PR:L), and yielding high confidentiality and integrity impact with no availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user in Company B sends GET requests to /product/update/{id} with sequentially enumerated numeric IDs, reading price, cost, stock quantity, SKU, and barcode fields belonging to Company A's product catalog without any additional privileges. The same user then POSTs to /product/save with the target product's id and their own company_id, silently transferring ownership of Company A's product record into Company B's inventory. … |
| Remediation | Upgrade to Prospero Flow CRM 5.4.7 or later; the vendor-confirmed patch is available at https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Roskus Prospero Flow CRM deployments and current version numbers, then notify leadership of the cross-tenant vulnerability and patch availability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prospero Flow Crm
View allCross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user
Cross-tenant transaction data exposure in Roskus Prospero Flow CRM 5.0.0-5.3.5 allows any authenticated user on a shared
Privilege escalation in Roskus Prospero Flow CRM before version 5.2.1 permits any authenticated user - regardless of ass
Broken function-level authorization in Prospero Flow CRM before 5.5.3 lets any authenticated low-privileged user (e.g. t
Cross-tenant IDOR in Roskus Prospero Flow CRM's ticket management component allows any authenticated user - regardless o
Cross-tenant payroll data exposure in Roskus Prospero Flow CRM before 5.15.10 enables authenticated users holding standa
Cross-tenant IDOR in Prospero Flow CRM before 5.4.8 allows any authenticated user to blindly overwrite contact records b
Unauthorized notification deletion in Prospero Flow CRM allows any authenticated user to delete other users' notificatio
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.5.3 allows any authenticated user to read, modify, and delete ord
Cross-tenant record injection in Roskus Prospero Flow CRM before 5.14.0 allows any authenticated user to silently insert
Tenant data boundary failure in Roskus Prospero Flow CRM 4.9.1-5.14.0 allows authenticated users holding transaction and
Stored cross-site scripting in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated Seller-role user to achiev
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today