Skip to main content

Prospero Flow CRM EUVDEUVD-2026-55634

| CVE-2026-19433 HIGH
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-08-10 Secur0 GHSA-8666-8wpq-7c9q
Authentication Bypass Prospero Flow Crm
8.6
CVSS 4.0 · Vendor: Secur0
Share

Severity by source

Vendor (Secur0) PRIMARY
8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.6 CRITICAL

Scope changes to other tenants (S:C) because exploitation crosses the multi-tenant authorization boundary; PR:L reflects required authenticated session; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Secur0).

CVSS VectorVendor: Secur0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 10, 2026 - 15:16 vuln.today
Analysis Generated
Aug 10, 2026 - 15:16 vuln.today
CVE Published
Aug 10, 2026 - 14:04 cve.org
HIGH 8.6

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact's numeric identifier, because the save and export operations retrieve the record without constraining the query to the authenticated user's company.

AnalysisAI

Cross-tenant IDOR in Prospero Flow CRM before 5.4.8 allows any authenticated user to blindly overwrite contact records belonging to other companies and exfiltrate their personal data as vCard files, simply by supplying an arbitrary numeric contact ID. The contact save and vCard export endpoints performed no company-scoping on their database queries, so a user authenticated to Company A could tamper with or harvest contacts owned by Company B without any special knowledge beyond a valid integer identifier. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to any company account
Delivery
Enumerate contact numeric IDs via sequential integer guessing
Exploit
POST /contact/save with cross-company contact ID
Execution
Overwrite victim company contact data
Persist
GET /contact/export-vcard/{id}
Impact
Exfiltrate personal data as vCard
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid authenticated session in any company tenant on the shared Prospero Flow CRM installation (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.6 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H reflects the reality accurately: exploitation is low-complexity and requires only a valid application login, achievable by any of potentially hundreds of tenant users in a shared instance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker authenticates to Prospero Flow CRM with a legitimate account belonging to their own company, then iterates integer values in POST requests to /contact/save or GET requests to /contact/export-vcard/{id}. Within seconds they can overwrite a competitor's contact records with arbitrary data or download personal contact information (name, email, phone) as vCard files for any contact stored in the shared instance. …
Remediation The primary fix is to upgrade Prospero Flow CRM to version 5.4.8 or later; version 5.5.3 is the latest tagged release at https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 and includes the complete patch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct a complete inventory of Prospero Flow CRM deployments, document version numbers and user access scope, and establish an emergency change control process. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Prospero Flow Crm

View all
CVE-2026-78365 CRITICAL
9.3 Aug 24

Cross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user
CVE-2026-77759 HIGH
8.7 Aug 21

Cross-tenant transaction data exposure in Roskus Prospero Flow CRM 5.0.0-5.3.5 allows any authenticated user on a shared
CVE-2026-59233 HIGH
8.7 Aug 10

Privilege escalation in Roskus Prospero Flow CRM before version 5.2.1 permits any authenticated user - regardless of ass
CVE-2026-59235 HIGH
8.7 Jul 15

Broken function-level authorization in Prospero Flow CRM before 5.5.3 lets any authenticated low-privileged user (e.g. t
CVE-2026-19539 HIGH
8.6 Aug 11

Cross-tenant IDOR in Roskus Prospero Flow CRM's ticket management component allows any authenticated user - regardless o
CVE-2026-19870 HIGH
8.6 Aug 14

Cross-tenant payroll data exposure in Roskus Prospero Flow CRM before 5.15.10 enables authenticated users holding standa
CVE-2026-19734 HIGH
8.6 Aug 13

Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.4.7 allows any authenticated user to read sensitive product recor
CVE-2026-59240 MEDIUM
6.9 Jul 27

Unauthorized notification deletion in Prospero Flow CRM allows any authenticated user to delete other users' notificatio
CVE-2026-59237 MEDIUM
6.9 Jul 16

Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.5.3 allows any authenticated user to read, modify, and delete ord
CVE-2026-59236 MEDIUM
6.9 Jul 15

Cross-tenant record injection in Roskus Prospero Flow CRM before 5.14.0 allows any authenticated user to silently insert
CVE-2026-77780 MEDIUM
5.3 Aug 21

Tenant data boundary failure in Roskus Prospero Flow CRM 4.9.1-5.14.0 allows authenticated users holding transaction and
CVE-2026-81931 MEDIUM
4.8 Aug 27

Stored cross-site scripting in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated Seller-role user to achiev

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-55634 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy