Vulnerability · Published Jul 15, 2026 · Assigned by Secur0
CVE-2026-59236Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection
Medium 6.9
In plain English
A medium-severity authorization bypass via user-controlled key in Prospero Flow CRM from Roskus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Official description
Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company's tenant via a spreadsheet whose company_id column points to the victim tenant, uploaded to POST /customer/import/excel/save, which maps company_id directly from the file and performs no check that it matches the authenticated user's company.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Roskus | Prospero Flow CRM | 1.0.0 – before 5.14.0 |
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References
- https://github.com/Roskus/prospero-flow-crm/commit/bdd6c9770a7435a45f0411154671b8a3e94dcdaa patch
- https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.14.0 release-notes
- https://secur0.com/en/cna/cve-list/cve-2026-59236-authorization-bypass-in-prospero-flow-crm-excel-import-allows-cross-tenant-record-injection technical-description