Vulnerability · Published Aug 24, 2026 · Assigned by Secur0

CVE-2026-78365IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

Critical 9.3

In plain English

A critical-severity authorization bypass via user-controlled key in Prospero Flow CRM from Roskus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.5%top 56.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.

Affected products (as reported)

Vendor	Product	Versions
Roskus	Prospero Flow CRM	4.0.0 – before 5.3.2

Weakness: CWE-639, CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/Roskus/prospero-flow-crm/commit/4a52477e6ed66afa436814c80e7bcd68670dd596 patch
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 release-notes
https://secur0.com/en/cna/cve-list/cve-2026-78365-idor-supplier-api-cross-tenant-update third-party-advisory, technical-description