CVE-2026-78365 PUBLISHED

IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

Assigner: Secur0
Reserved: 24.08.2026 Published: 24.08.2026 Updated: 24.08.2026

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 9.3

Product Status

Vendor Roskus
Product Prospero Flow CRM
Versions Default: unaffected
  • affected from 4.0.0 to 5.3.2 (excl.)

Solutions

Upgrade to 5.3.2 or later; first tagged release with the fix is v5.5.3. Review the supplier table for altered company_id values and rotate exposed order-portal credentials and bank details.

Credits

  • Antonio Rivera Poblete finder
  • Xoán M. Otero Jorge analyst
  • Cristian Fernández Cornejo analyst
  • Secur0 CNA coordinator
  • Gustavo Novaro remediation developer

References

Problem Types

  • CWE-639 Authorization bypass through User-Controlled key CWE
  • CWE-862 Missing Authorization CWE

Impacts

  • CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs