Prospero Flow CRM CVE-2026-78365

Requires a valid authenticated session on the platform (the fix logic depends on Auth::user()->company_id, and the description says 'any authenticated user'), but no elevated role or special configuration in the affected 4.0.0-5.3.1 versions - the vulnerable endpoint is the default supplier API. The concrete prerequisite is issuing a PUT (or PATCH) to /api/supplier/{id} with a target supplier ID from another tenant and a company_id value in the request body. Limiting factors: the attacker must have a working account and must know or enumerate a valid supplier {id}; there is no user interaction and no non-default configuration needed. Note the vendor CVSS marks PR:N (unauthenticated), which conflicts with the 'authenticated user' description - treat authentication as required per the source evidence.

Signals are strong but partly conflicting. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) scores 9.3 and encodes PR:N (unauthenticated), yet the description explicitly states 'any authenticated user' - this is a material contradiction; the source diff (which relies on Auth::user()->company_id) confirms an authenticated session is required, so the realistic privilege level is PR:L, not PR:N. Attack complexity is genuinely low: no special conditions, no user interaction, and the exploit is a single well-formed PUT request that is easily automatable. There is no EPSS score provided, it is not KEV-listed, and no public POC is identified, so this is not confirmed as actively exploited - but the fix commit is public, making an exploit trivial to derive. Net: a real, high-priority tenant-isolation break for any organization running the affected versions, tempered mainly by the requirement for a valid low-privilege account and the product's limited deployment footprint.

An attacker registers or already holds a low-privilege account in one tenant, enumerates or guesses a supplier ID belonging to a competitor tenant, and sends PUT /api/supplier/{id} with a JSON body containing company_id set to their own company. The server, lacking tenant scoping, updates the victim's supplier record and reassigns it to the attacker's company, exposing and altering another organization's data. No public POC is identified, but the network vector and low complexity (single request, no user interaction) make weaponization straightforward from the published patch diff.