Roskus Prospero Flow CRM

• CVE-2026-114519 High 8.6 Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts 0.4%
• CVE-2026-82911 Medium 5.1 CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes 0.2%
• CVE-2026-81931 Medium 4.8 Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting 0.5%
• CVE-2026-78365 Critical 9.3 IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification 0.5%
• CVE-2026-78337 Medium 4.8 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG 0.4%
• CVE-2026-77780 Medium 5.3 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers 0.4%
• CVE-2026-77759 High 8.7 IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records 0.5%
• CVE-2026-19871 Critical 9.3 Use of hard-coded credentials in Prospero Flow CRM employee onboarding 0.5%
• CVE-2026-19870 High 8.6 IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation 0.4%
• CVE-2026-19734 High 8.6 IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking 0.6%
• CVE-2026-19539 High 8.6 IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion 0.4%
• CVE-2026-19433 High 8.6 Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export 0.4%
• CVE-2026-59233 High 8.7 Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation 0.4%
• CVE-2026-59232 Medium 5.3 Stored Cross-site Scripting in Prospero Flow CRM lead name field 0.5%
• CVE-2026-59240 Medium 6.9 IDOR in Prospero Flow CRM allows deletion of other users' notifications 0.5%
• CVE-2026-59239 High 8.6 Stored XSS in Prospero Flow CRM email body allows administrator account takeover 0.7%
• CVE-2026-59237 Medium 6.9 IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders 0.6%
• CVE-2026-59236 Medium 6.9 Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection 0.6%
• CVE-2026-59235 High 8.7 Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts 0.7%
• CVE-2026-59234 Medium 6.9 Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion 0.6%