Prospero Flow CRM CVE-2026-59236

Exploitation requires a valid authenticated session in any user role within a Prospero Flow CRM instance before version 5.14.0 - the CVE description confirms 'any role or company' is sufficient, meaning the lowest-privileged non-admin account qualifies (the provided CVSS 4.0 vector's PR:N is a scoring error contradicting this requirement). The deployment must be multi-tenant; single-tenant installations have no second company namespace to target and are not at risk from cross-tenant injection. The attacker must supply a valid company_id integer for the victim tenant in the spreadsheet column, which may be sequentially guessable or observable through normal application interaction. The Excel import feature must be accessible to the attacker's assigned role - if the application restricts import endpoints to administrator roles only, the exploitable population narrows to those privileged accounts. No special network position, no man-in-the-middle capability, and no interaction from any user in the victim company are required.

The provided CVSS 4.0 vector lists PR:N (no privileges required), which directly conflicts with the CVE description, which explicitly states exploitation requires 'a remote, authenticated user of any role or company' - this is a confirmed CVSS scoring error that overstates the unauthenticated attack surface and must not be used for risk-tier decisions without correction. Correcting to PR:L, the exploitable population is limited to users holding valid credentials in a multi-tenant deployment. The integrity impact is real but bounded: attackers can inject spurious records into victim tenants but cannot read or exfiltrate victim tenant data (VC:N). No EPSS data was supplied. No CISA KEV listing and no public proof-of-concept code have been identified, indicating no known active or widespread exploitation at time of analysis. The primary real-world risk is business-logic disruption - contaminating a competitor's or customer's CRM data, polluting audit trails in regulated industries, or enabling denial-of-accuracy attacks on sales pipelines - rather than direct data exfiltration. Priority is moderate for multi-tenant SaaS deployments; minimal for single-tenant installations where no second tenant namespace exists to target.

An authenticated user at Company A constructs an Excel spreadsheet in which the company_id column is populated with Company B's tenant identifier - obtainable by observing the application UI, enumerating integer IDs, or through prior legitimate access - and uploads it to the CRM's customer import endpoint. The server maps company_id directly from the file and creates the specified customer, lead, or product records within Company B's data namespace with no ownership check, silently polluting their CRM data. No elevated privileges within the application, no victim-side interaction, and no special tooling beyond a spreadsheet editor and an HTTP client are required.