CVE-2026-78365
Received Received - Intake

Authorization Bypass in Roskus Prospero Flow CRM

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Secur0

Description
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78365
EUVD
EUVD-2026-64839

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
roskus prospero_flow_crm From 4.0.0 (inc) to 5.3.1 (inc)
roskus prospero_flow_crm 4.0.0
roskus prospero_flow_crm 5.3.1
roskus prospero_flow_crm From 5.3.2 (inc)
roskus prospero_flow_crm 5.5.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78365 is an authorization bypass vulnerability in Roskus Prospero Flow CRM versions 4.0.0 through 5.3.1. It allows authenticated users to read or modify another company's supplier records by exploiting an Insecure Direct Object Reference (IDOR) in the supplier API. The flaw occurs because the system does not properly check if a user has permission to access or modify a specific supplier record belonging to another company.

Detection Guidance

Check API logs for PUT requests to /api/supplier/{id} with company_id in the request body. Look for requests where the authenticated user's company_id differs from the supplier's company_id. Review supplier records for unauthorized company_id changes or access to sensitive fields like account_number.

Impact Analysis

This vulnerability allows attackers to access sensitive supplier data such as bank details and credentials, modify supplier records, or reassign them to their own company. This could lead to financial fraud, data breaches, or unauthorized changes to business relationships. The impact is severe as it affects multi-tenant environments where companies share the same CRM instance.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA. It enables unauthorized access to sensitive personal and financial data, which could result in data breaches. Organizations using affected versions may face regulatory penalties, legal liabilities, and reputational damage due to non-compliance with data protection standards.

Mitigation Strategies

Upgrade to Prospero Flow CRM version 5.3.2 or later. Review the supplier table for unauthorized company_id changes and rotate exposed credentials. Ensure the SupplierUpdateController update method filters by company_id and uses $request->validated() to block mass assignment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78365. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart