Vulnerability details
CVE-2026-78365
Roskus Prospero Flow CRM
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
CVSS 4.0
9.3Critical
Official description
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (Secur0) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Roskus | Prospero Flow CRM | 4.0.0 ≤ v < 5.3.2 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/Roskus/prospero-flow-crm/commit/4a52477e6ed66afa436814c80e7bcd68670dd596 patch
- https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 release-notes
- https://secur0.com/en/cna/cve-list/cve-2026-78365-idor-supplier-api-cross-tenant-update third-party-advisorytechnical-description
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-24
- Last updated
- 2026-08-24
- State
- Published
- Assigner (CNA)
- Secur0
Exploit prediction (EPSS)
0.5%
Probability of exploitation in 30 days
43.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-639Authorization bypass through User-Controlled key
- CWE-862Missing Authorization