Prospero Flow Crm
Monthly
Cross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user of one company read, modify, and even hijack supplier records belonging to other companies by sending a PUT to /api/supplier/{id} and supplying an arbitrary company_id in the body. The supplier lookup was not scoped to the caller's tenant and mass-assignment allowed re-parenting a record to the attacker's own company, breaking multi-tenant isolation. A vendor patch exists (5.3.2) and the fix is visible in a public GitHub commit; there is no public exploit identified and it is not on CISA KEV, but the flaw is trivially reproducible from the diff.
Cross-tenant transaction data exposure in Roskus Prospero Flow CRM 5.0.0-5.3.5 allows any authenticated user on a shared instance to read financial transaction records belonging to other companies by iterating the integer ID in GET /api/transaction/{id}, which performed no company-scoping and no permission check. Source code analysis of the fix confirms the vulnerable controller called Transaction::find($id) directly against the full dataset, making every transaction on the instance reachable to any valid session. No CISA KEV listing exists and no public exploit code has been identified, though the trivial exploitation pattern (sequential integer enumeration) requires minimal skill.
Cross-tenant payroll data exposure in Roskus Prospero Flow CRM before 5.15.10 enables authenticated users holding standard payroll permissions to read salary and banking details belonging to employees of entirely separate companies within the same multi-tenant instance, and to create payroll records attributed to those foreign employees. The flaw exists at the query layer: the payroll listing endpoint omits a company_id scope constraint, and payroll creation validates employee identifiers for global database existence rather than for membership in the caller's own company. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation barrier makes this an urgent priority for any multi-tenant deployment.
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.4.7 allows any authenticated user to read sensitive product records belonging to other tenant companies and reassign those products into their own account. Two compounding root causes drive the impact: ProductUpdateController lacked the MainController inheritance that enforces session-based authorization, leaving the product read endpoint unguarded, while ProductRepository::save() performed a bare Product::find($data['id']) lookup with no company_id scope constraint, enabling cross-tenant record hijacking. No public exploit or CISA KEV listing exists at time of analysis, but the exploit conditions are trivially met by any authenticated session holder.
Cross-tenant IDOR in Roskus Prospero Flow CRM's ticket management component allows any authenticated user - regardless of company affiliation - to read full ticket content (titles, descriptions, attachments), hijack tickets by overwriting their company_id, and delete tickets belonging to any other tenant on the shared instance. The root cause is a missing authorization boundary in three distinct Eloquent query paths that retrieve tickets by numeric ID without scoping results to the authenticated user's company, compounded by the delete controller accepting a generic HTTP request class that bypassed the application's own permission gate entirely. No public exploit code or CISA KEV listing exists at time of analysis; however, the Secur0 advisory documents the attack surface with sufficient detail for reproduction, and the CVSS 4.0 score of 8.6 reflects the genuine severity of multi-tenant isolation failure.
Cross-tenant IDOR in Prospero Flow CRM before 5.4.8 allows any authenticated user to blindly overwrite contact records belonging to other companies and exfiltrate their personal data as vCard files, simply by supplying an arbitrary numeric contact ID. The contact save and vCard export endpoints performed no company-scoping on their database queries, so a user authenticated to Company A could tamper with or harvest contacts owned by Company B without any special knowledge beyond a valid integer identifier. No public exploit or CISA KEV listing has been identified at time of analysis, but the vulnerability is trivially exploitable in any multi-tenant deployment and the full fix has been released as v5.4.8 (and later v5.5.3).
Privilege escalation in Roskus Prospero Flow CRM before version 5.2.1 permits any authenticated user - regardless of assigned role - to grant any application role the complete set of system permissions by sending a crafted POST request to the permission save endpoint. The vulnerable `PermissionSaveController` accepted a user-supplied `roles` array and invoked Spatie Permission's `syncPermissions()` with no prior authorization check, making low-trust authenticated accounts a direct path to full administrative control. No public exploit or CISA KEV listing has been identified at time of analysis, but the publicly accessible commit diff documents the exact endpoint and flaw mechanism, substantially lowering the exploitation barrier for any attacker holding CRM credentials.
Broken function-level authorization in Prospero Flow CRM before 5.5.3 lets any authenticated low-privileged user (e.g. the standard 'User'/'Usuario' role) read every bank account record belonging to their company via GET /api/bank-account. The API route is guarded only by auth:api with no permission gate — unlike the web equivalent, which enforces can('read bank') — so any valid bearer token returns sensitive banking data (IBAN, SWIFT/BIC, account identifiers). A vendor patch exists (5.5.3) and the fixing commit is public; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV.
Order confirmation in Roskus Prospero Flow CRM before 5.15.11 can be triggered by an unauthenticated attacker on behalf of any authenticated user through a classic CSRF exploit. The root cause is a state-changing action exposed via HTTP GET at /order/confirm/{order_number}, which Laravel's VerifyCsrfToken middleware does not protect - middleware enforcement is limited to POST, PUT, PATCH, and DELETE. Because session cookies are configured with SameSite=Lax, a single crafted link navigated by the victim automatically includes their session cookie, silently transitioning the target order from pending to confirmed. Sequential integer order numbers further allow an attacker to enumerate and mass-confirm all outstanding orders in a single automated sweep. No public exploit or KEV listing is identified at time of analysis; vendor patch is available in 5.15.11.
Stored cross-site scripting in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated Seller-role user to achieve first-party script execution in other users' browser sessions by exploiting an extension-confusion flaw in the product photo upload feature. The application validates file content via magic bytes and rejects known PHP extensions, but then names the stored file using the attacker-supplied client extension - allowing a file prefixed with an image header and carrying an .html extension to pass validation, land in the public web root, and be served as text/html. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 score of 4.8 reflects the authentication and victim-interaction prerequisites.
Tenant data boundary failure in Roskus Prospero Flow CRM 4.9.1-5.14.0 allows authenticated users holding transaction and accounting creation permissions to read another co-tenant company's bank account name, institution name, and card last four digits by supplying a foreign bank_account_id or bank_card_id in POST /transaction/save. The root cause (CWE-639, IDOR) is the complete absence of company-ownership validation on user-controlled integer foreign keys before they are persisted and rendered - the controller correctly scoped the new transaction's company_id but applied no such scoping to associated reference IDs. No active exploitation or public POC has been identified at time of analysis; a vendor fix is available upstream via GitHub commit 5fd1fe8 and PR #261.
Unauthorized notification deletion in Prospero Flow CRM allows any authenticated user to delete other users' notifications by manipulating the ID parameter in the /notification/delete/{id} endpoint. Sequential notification IDs enable systematic deletion across the system, disrupting user awareness of critical business events. A vendor fix is available in version 5.5.3, and no active exploitation has been reported.
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.5.3 allows any authenticated user to read, modify, and delete order and order-item records belonging to other companies (tenants) by supplying sequential integer IDs to five REST API endpoints. The root cause is missing company_id scoping in Eloquent ORM queries across all Order and OrderItem controllers, making every tenant's order data globally accessible to any platform user. No public exploit code or CISA KEV entry exists at time of analysis, but exploitation requires only a valid account and standard HTTP iteration - no special tools or expertise needed.
Cross-tenant record injection in Roskus Prospero Flow CRM before 5.14.0 allows any authenticated user to silently insert customer, lead, and product records into a competing company's tenant by manipulating the company_id field in an uploaded Excel spreadsheet. The three affected import handlers (CustomerImport, LeadImport, ProductImport) map company_id directly from the user-controlled file without verifying it matches the authenticated session's own company, collapsing the multi-tenant data isolation boundary. No public exploit has been identified at time of analysis; vendor-released patch v5.14.0 is available and confirmed.
Cross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user of one company read, modify, and even hijack supplier records belonging to other companies by sending a PUT to /api/supplier/{id} and supplying an arbitrary company_id in the body. The supplier lookup was not scoped to the caller's tenant and mass-assignment allowed re-parenting a record to the attacker's own company, breaking multi-tenant isolation. A vendor patch exists (5.3.2) and the fix is visible in a public GitHub commit; there is no public exploit identified and it is not on CISA KEV, but the flaw is trivially reproducible from the diff.
Cross-tenant transaction data exposure in Roskus Prospero Flow CRM 5.0.0-5.3.5 allows any authenticated user on a shared instance to read financial transaction records belonging to other companies by iterating the integer ID in GET /api/transaction/{id}, which performed no company-scoping and no permission check. Source code analysis of the fix confirms the vulnerable controller called Transaction::find($id) directly against the full dataset, making every transaction on the instance reachable to any valid session. No CISA KEV listing exists and no public exploit code has been identified, though the trivial exploitation pattern (sequential integer enumeration) requires minimal skill.
Cross-tenant payroll data exposure in Roskus Prospero Flow CRM before 5.15.10 enables authenticated users holding standard payroll permissions to read salary and banking details belonging to employees of entirely separate companies within the same multi-tenant instance, and to create payroll records attributed to those foreign employees. The flaw exists at the query layer: the payroll listing endpoint omits a company_id scope constraint, and payroll creation validates employee identifiers for global database existence rather than for membership in the caller's own company. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation barrier makes this an urgent priority for any multi-tenant deployment.
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.4.7 allows any authenticated user to read sensitive product records belonging to other tenant companies and reassign those products into their own account. Two compounding root causes drive the impact: ProductUpdateController lacked the MainController inheritance that enforces session-based authorization, leaving the product read endpoint unguarded, while ProductRepository::save() performed a bare Product::find($data['id']) lookup with no company_id scope constraint, enabling cross-tenant record hijacking. No public exploit or CISA KEV listing exists at time of analysis, but the exploit conditions are trivially met by any authenticated session holder.
Cross-tenant IDOR in Roskus Prospero Flow CRM's ticket management component allows any authenticated user - regardless of company affiliation - to read full ticket content (titles, descriptions, attachments), hijack tickets by overwriting their company_id, and delete tickets belonging to any other tenant on the shared instance. The root cause is a missing authorization boundary in three distinct Eloquent query paths that retrieve tickets by numeric ID without scoping results to the authenticated user's company, compounded by the delete controller accepting a generic HTTP request class that bypassed the application's own permission gate entirely. No public exploit code or CISA KEV listing exists at time of analysis; however, the Secur0 advisory documents the attack surface with sufficient detail for reproduction, and the CVSS 4.0 score of 8.6 reflects the genuine severity of multi-tenant isolation failure.
Cross-tenant IDOR in Prospero Flow CRM before 5.4.8 allows any authenticated user to blindly overwrite contact records belonging to other companies and exfiltrate their personal data as vCard files, simply by supplying an arbitrary numeric contact ID. The contact save and vCard export endpoints performed no company-scoping on their database queries, so a user authenticated to Company A could tamper with or harvest contacts owned by Company B without any special knowledge beyond a valid integer identifier. No public exploit or CISA KEV listing has been identified at time of analysis, but the vulnerability is trivially exploitable in any multi-tenant deployment and the full fix has been released as v5.4.8 (and later v5.5.3).
Privilege escalation in Roskus Prospero Flow CRM before version 5.2.1 permits any authenticated user - regardless of assigned role - to grant any application role the complete set of system permissions by sending a crafted POST request to the permission save endpoint. The vulnerable `PermissionSaveController` accepted a user-supplied `roles` array and invoked Spatie Permission's `syncPermissions()` with no prior authorization check, making low-trust authenticated accounts a direct path to full administrative control. No public exploit or CISA KEV listing has been identified at time of analysis, but the publicly accessible commit diff documents the exact endpoint and flaw mechanism, substantially lowering the exploitation barrier for any attacker holding CRM credentials.
Broken function-level authorization in Prospero Flow CRM before 5.5.3 lets any authenticated low-privileged user (e.g. the standard 'User'/'Usuario' role) read every bank account record belonging to their company via GET /api/bank-account. The API route is guarded only by auth:api with no permission gate — unlike the web equivalent, which enforces can('read bank') — so any valid bearer token returns sensitive banking data (IBAN, SWIFT/BIC, account identifiers). A vendor patch exists (5.5.3) and the fixing commit is public; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV.
Order confirmation in Roskus Prospero Flow CRM before 5.15.11 can be triggered by an unauthenticated attacker on behalf of any authenticated user through a classic CSRF exploit. The root cause is a state-changing action exposed via HTTP GET at /order/confirm/{order_number}, which Laravel's VerifyCsrfToken middleware does not protect - middleware enforcement is limited to POST, PUT, PATCH, and DELETE. Because session cookies are configured with SameSite=Lax, a single crafted link navigated by the victim automatically includes their session cookie, silently transitioning the target order from pending to confirmed. Sequential integer order numbers further allow an attacker to enumerate and mass-confirm all outstanding orders in a single automated sweep. No public exploit or KEV listing is identified at time of analysis; vendor patch is available in 5.15.11.
Stored cross-site scripting in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated Seller-role user to achieve first-party script execution in other users' browser sessions by exploiting an extension-confusion flaw in the product photo upload feature. The application validates file content via magic bytes and rejects known PHP extensions, but then names the stored file using the attacker-supplied client extension - allowing a file prefixed with an image header and carrying an .html extension to pass validation, land in the public web root, and be served as text/html. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 score of 4.8 reflects the authentication and victim-interaction prerequisites.
Tenant data boundary failure in Roskus Prospero Flow CRM 4.9.1-5.14.0 allows authenticated users holding transaction and accounting creation permissions to read another co-tenant company's bank account name, institution name, and card last four digits by supplying a foreign bank_account_id or bank_card_id in POST /transaction/save. The root cause (CWE-639, IDOR) is the complete absence of company-ownership validation on user-controlled integer foreign keys before they are persisted and rendered - the controller correctly scoped the new transaction's company_id but applied no such scoping to associated reference IDs. No active exploitation or public POC has been identified at time of analysis; a vendor fix is available upstream via GitHub commit 5fd1fe8 and PR #261.
Unauthorized notification deletion in Prospero Flow CRM allows any authenticated user to delete other users' notifications by manipulating the ID parameter in the /notification/delete/{id} endpoint. Sequential notification IDs enable systematic deletion across the system, disrupting user awareness of critical business events. A vendor fix is available in version 5.5.3, and no active exploitation has been reported.
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.5.3 allows any authenticated user to read, modify, and delete order and order-item records belonging to other companies (tenants) by supplying sequential integer IDs to five REST API endpoints. The root cause is missing company_id scoping in Eloquent ORM queries across all Order and OrderItem controllers, making every tenant's order data globally accessible to any platform user. No public exploit code or CISA KEV entry exists at time of analysis, but exploitation requires only a valid account and standard HTTP iteration - no special tools or expertise needed.
Cross-tenant record injection in Roskus Prospero Flow CRM before 5.14.0 allows any authenticated user to silently insert customer, lead, and product records into a competing company's tenant by manipulating the company_id field in an uploaded Excel spreadsheet. The three affected import handlers (CustomerImport, LeadImport, ProductImport) map company_id directly from the user-controlled file without verifying it matches the authenticated session's own company, collapsing the multi-tenant data isolation boundary. No public exploit has been identified at time of analysis; vendor-released patch v5.14.0 is available and confirmed.