CVE-2026-19734
Received Received - Intake

Authorization Bypass in Roskus Prospero Flow CRM

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: 4daa8cea-433a-44bd-9456-53b127fc289a

Description
Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and to hijack that product by reassigning its company_id, via the product's numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data['id'])` without constraining the query to the authenticated user's company before overwriting its company_id.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-19734
EUVD
EUVD-2026-57924

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
roskus prospero_flow_crm 5.4.6
roskus prospero_flow_crm 5.4.7
roskus prospero_flow_crm 5.5.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19734 is an authorization bypass and IDOR vulnerability in Roskus Prospero Flow CRM before version 5.4.7. It allows authenticated users from any company to read sensitive product data (price, cost, stock, SKU, barcode) belonging to other companies and hijack those products by reassigning their company_id via the product's numeric identifier. The flaw exists because ProductUpdateController did not extend MainController, bypassing authentication checks, and ProductRepository::save() did not filter products by the authenticated user's company_id before overwriting data.

Detection Guidance

To detect this vulnerability, check if your Prospero Flow CRM version is 5.4.6 or earlier. Verify if authenticated users can access product data or modify company_id fields across tenants. Inspect network traffic for requests to /product/update/{id} or /product/save endpoints without proper authorization checks.

Impact Analysis

This vulnerability allows unauthorized users to access and steal sensitive product information from other companies, potentially leading to financial loss, competitive disadvantage, or reputational damage. Attackers could manipulate product ownership, disrupt inventory management, or misuse proprietary data. The impact is significant for businesses using Prospero Flow CRM versions before 5.4.7.

Compliance Impact

This vulnerability likely violates GDPR's data protection principles by enabling unauthorized access to sensitive product data, which may include personal or proprietary information. It could also breach HIPAA if product data includes protected health information. Organizations using affected versions may face compliance violations, legal penalties, and loss of customer trust.

Mitigation Strategies

Immediately upgrade Prospero Flow CRM to version 5.4.7 or higher. Ensure ProductUpdateController and ProductCreateController extend MainController to enforce authentication. Verify ProductRepository::save() filters products by company_id during updates. Test cross-tenant access restrictions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19734. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart