Prospero Flow CRM CVE-2026-59237

Exploitation requires a valid, authenticated user session for any tenant account on the Prospero Flow CRM instance - a standard low-privilege user with no administrative rights is sufficient (PR:L). The attacker must have network access to the REST API (typically HTTPS on port 443). All five vulnerable endpoints are affected in their default configuration with no special feature flag or non-standard setup required: GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, and DELETE /api/order-item/{id}. Exploitation is strictly limited to authenticated sessions - unauthenticated access to these endpoints is not possible, making account acquisition the sole prerequisite. Single-tenant deployments where only one company exists in the database would observe no exploitable cross-tenant impact, though the vulnerability is structurally present.

A notable discrepancy exists in the provided CVSS 4.0 vector: PR:N (no privileges required) directly contradicts the CVE description, which explicitly states exploitation requires a remote authenticated user. PR:N is treated as a scoring error; PR:L is the correct metric given the authentication prerequisite. Real-world risk is elevated for any multi-tenant deployment: a single malicious or compromised tenant account grants full read/write/delete access to every other company's order data. The low attack complexity (AC:L, sequential integer IDs, standard REST verbs) means any authenticated user can exploit this without specialized tooling. The CVSS 4.0 impact metrics VC:L/VI:L may understate business risk in a CRM context, where order data routinely contains PII, pricing, and commercially sensitive customer information. No KEV listing and no public exploit code identified at time of analysis, but the attack pattern is self-evident from API discovery. SSVC signals suggest: exploitation is plausible (authenticated account obtainable), automatable (sequential ID enumeration is scriptable), and technical impact is partial on the vulnerable system with significant cross-tenant data exposure.

An attacker registers or compromises any low-privilege user account on a shared Prospero Flow CRM instance, then authenticates and iterates GET /api/order/1 through /api/order/N to harvest every order in the database across all tenants. With targeted order IDs in hand, the attacker issues PUT /api/order/{id} requests to manipulate competitor pricing or delivery details, and DELETE /api/order-item/{id} to silently destroy line items belonging to other companies. No exploit toolkit is required - the attack is executable with curl or any REST client.