Vulnerability · Published Aug 11, 2026 · Assigned by Secur0
CVE-2026-19539IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion
High 8.6
In plain English
A high-severity missing authorization in Prospero Flow CRM from Roskus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content (title, description, and attachments) of tickets belonging to another company, to hijack another company's tickets by reassigning their company_id, and to delete another company's tickets without any authorization check, via the ticket's numeric identifier, because the read and save operations retrieve the record without constraining the query to the authenticated user's company, and the delete controller type-hints a generic Illuminate\Http\Request instead of the TicketDeleteRequest that would enforce the required permission.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Roskus | Prospero Flow CRM | 0 – before 5.4.9 |
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/Roskus/prospero-flow-crm/commit/b2b6ffdace0972ab62d1f7e8cdab0ed213bfc4a9 patch
- https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 release-notes
- https://secur0.com/en/cna/cve-list/cve-2026-19539-idor-in-prospero-flow-crm-allows-cross-tenant-ticket-read-hijacking-and-deletion technical-description