EUVD-2026-44622
GHSA-rpp3-j482-5g39
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated attacker (PR:L) crosses tenant boundary (S:C) achieving low integrity-only impact; no confidentiality or availability effect applies.
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
Lifecycle Timeline
2DescriptionCVE.org
Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company's tenant via a spreadsheet whose company_id column points to the victim tenant, uploaded to POST /customer/import/excel/save, which maps company_id directly from the file and performs no check that it matches the authenticated user's company.
AnalysisAI
Cross-tenant record injection in Roskus Prospero Flow CRM before 5.14.0 allows any authenticated user to silently insert customer, lead, and product records into a competing company's tenant by manipulating the company_id field in an uploaded Excel spreadsheet. The three affected import handlers (CustomerImport, LeadImport, ProductImport) map company_id directly from the user-controlled file without verifying it matches the authenticated session's own company, collapsing the multi-tenant data isolation boundary. No public exploit has been identified at time of analysis; vendor-released patch v5.14.0 is available and confirmed.
Technical ContextAI
Prospero Flow CRM is a PHP/Laravel-based multi-tenant CRM application (CPE: cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the model constructors in CustomerImport.php, LeadImport.php, and ProductImport.php previously read the company_id field directly from the uploaded spreadsheet row ($row['company_id']) and persisted it to the database without any server-side ownership assertion. The fix replaces that assignment with Auth::user()->company_id - the server-authoritative value bound to the authenticated Laravel session - in all three handlers. The attack surface is the POST /customer/import/excel/save endpoint (and equivalent lead and product import paths) that process multipart Excel uploads via the Laravel Excel (Maatwebsite) package using the ToModel, WithHeadingRow, and WithValidation interfaces. Because the validation pipeline never compared the file's company_id to the session's company_id, the flaw survived any schema-level validation in place.
RemediationAI
Upgrade to Prospero Flow CRM version 5.14.0 or later, which resolves the vulnerability by replacing $row['company_id'] with Auth::user()->company_id in all three import handlers (patch commit bdd6c9770a7435a45f0411154671b8a3e94dcdaa, available at https://github.com/Roskus/prospero-flow-crm/commit/bdd6c9770a7435a45f0411154671b8a3e94dcdaa; tagged release at https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.14.0). If immediate upgrade is not feasible, restrict access to the Excel import endpoints (POST /customer/import/excel/save and equivalent lead and product paths) to a minimal set of trusted administrative roles via Laravel middleware or web server ACLs - note this disables bulk import functionality entirely for all affected role tiers, which may impact daily operations. A lower-disruption compensating control is to add an application-level validation rule asserting that every company_id value in each spreadsheet row equals Auth::user()->company_id before any record is created; this blocks cross-tenant injection while preserving import usability, with no side effects for compliant uploads but requiring a custom code patch if full upgrade is deferred.
More in Prospero Flow Crm
View allCross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user
Cross-tenant transaction data exposure in Roskus Prospero Flow CRM 5.0.0-5.3.5 allows any authenticated user on a shared
Privilege escalation in Roskus Prospero Flow CRM before version 5.2.1 permits any authenticated user - regardless of ass
Broken function-level authorization in Prospero Flow CRM before 5.5.3 lets any authenticated low-privileged user (e.g. t
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.4.7 allows any authenticated user to read sensitive product recor
Cross-tenant IDOR in Roskus Prospero Flow CRM's ticket management component allows any authenticated user - regardless o
Cross-tenant payroll data exposure in Roskus Prospero Flow CRM before 5.15.10 enables authenticated users holding standa
Cross-tenant IDOR in Prospero Flow CRM before 5.4.8 allows any authenticated user to blindly overwrite contact records b
Unauthorized notification deletion in Prospero Flow CRM allows any authenticated user to delete other users' notificatio
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.5.3 allows any authenticated user to read, modify, and delete ord
Tenant data boundary failure in Roskus Prospero Flow CRM 4.9.1-5.14.0 allows authenticated users holding transaction and
Order confirmation in Roskus Prospero Flow CRM before 5.15.11 can be triggered by an unauthenticated attacker on behalf
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today