EUVD-2026-44932
GHSA-x8qq-m4qc-rpj5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated low-privilege account (PR:L); REST API over network (AV:N); crosses tenant isolation boundary affecting other companies' data (S:C); no availability impact.
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
Lifecycle Timeline
2DescriptionCVE.org
Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company (tenant) via a sequential numeric {id} supplied to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or DELETE /api/order-item/{id}, because the controllers resolve records with Order::find($id) / Item::find($id) without scoping by the authenticated user's company.
AnalysisAI
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.5.3 allows any authenticated user to read, modify, and delete order and order-item records belonging to other companies (tenants) by supplying sequential integer IDs to five REST API endpoints. The root cause is missing company_id scoping in Eloquent ORM queries across all Order and OrderItem controllers, making every tenant's order data globally accessible to any platform user. No public exploit code or CISA KEV entry exists at time of analysis, but exploitation requires only a valid account and standard HTTP iteration - no special tools or expertise needed.
Technical ContextAI
Prospero Flow CRM (CPE: cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*) is a PHP/Laravel SaaS CRM supporting multiple isolated tenants (companies). The affected controllers - OrderReadController, OrderUpdateController, OrderItemReadController, OrderItemUpdateController, and OrderItemDeleteController - resolved records using bare Eloquent calls (Order::find($id) and Item::find($id)) that perform a primary-key lookup with no WHERE clause filtering by the authenticated user's company_id. This is a canonical CWE-639 (Authorization Bypass Through User-Controlled Key) / IDOR flaw: the integer {id} path parameter is entirely user-controlled, and because Laravel's Eloquent find() resolves globally across all tenants, any valid session can address any record in the database. Sequential auto-increment primary keys make enumeration trivial. The fix committed at 9a859c4 adds ->where('company_id', Auth::user()->company_id) to all Order queries and whereHas('order', fn($q) => $q->where('company_id', ...)) for OrderItem relations, restoring tenant isolation at the ORM layer.
RemediationAI
Upgrade to Prospero Flow CRM version 5.5.3 or later, available at https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3; the remediation commit is https://github.com/Roskus/prospero-flow-crm/commit/9a859c4de3d49674916773d346c60d89ad7febe0 and can be reviewed to confirm scope. If immediate upgrade is not feasible, a compensating control is to restrict access to the /api/order/* and /api/order-item/* endpoint paths at the web server or API gateway layer to explicitly allowlisted IP ranges corresponding to known legitimate API consumers - this eliminates opportunistic enumeration from arbitrary authenticated sessions but will break any API integration operating from dynamic or unlisted IPs. A second compensating control is rate-limiting or anomaly detection on the order API endpoints to flag high-volume sequential ID requests, though this detects rather than prevents exploitation. There is no application-level workaround that preserves full API functionality without applying the patch.
More in Prospero Flow Crm
View allCross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user
Cross-tenant transaction data exposure in Roskus Prospero Flow CRM 5.0.0-5.3.5 allows any authenticated user on a shared
Privilege escalation in Roskus Prospero Flow CRM before version 5.2.1 permits any authenticated user - regardless of ass
Broken function-level authorization in Prospero Flow CRM before 5.5.3 lets any authenticated low-privileged user (e.g. t
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.4.7 allows any authenticated user to read sensitive product recor
Cross-tenant IDOR in Roskus Prospero Flow CRM's ticket management component allows any authenticated user - regardless o
Cross-tenant payroll data exposure in Roskus Prospero Flow CRM before 5.15.10 enables authenticated users holding standa
Cross-tenant IDOR in Prospero Flow CRM before 5.4.8 allows any authenticated user to blindly overwrite contact records b
Unauthorized notification deletion in Prospero Flow CRM allows any authenticated user to delete other users' notificatio
Cross-tenant record injection in Roskus Prospero Flow CRM before 5.14.0 allows any authenticated user to silently insert
Tenant data boundary failure in Roskus Prospero Flow CRM 4.9.1-5.14.0 allows authenticated users holding transaction and
Order confirmation in Roskus Prospero Flow CRM before 5.15.11 can be triggered by an unauthenticated attacker on behalf
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today