Vulnerability · Published Aug 13, 2026 · Assigned by Secur0
CVE-2026-19734IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking
High 8.6
In plain English
A high-severity authorization bypass via user-controlled key in Prospero Flow CRM from Roskus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Official description
Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and to hijack that product by reassigning its company_id, via the product's numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data['id'])` without constraining the query to the authenticated user's company before overwriting its company_id.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Roskus | Prospero Flow CRM | 0 – before 5.4.7 |
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/Roskus/prospero-flow-crm/commit/f36c2a115f4c28c82181f1798c01582ae953b932 patch
- https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 release-notes
- https://secur0.com/en/cna/cve-list/cve-2026-19734-idor-in-prospero-flow-crm-allows-cross-tenant-product-disclosure-and-hijacking technical-description