CVE-2026-19433 in Prospero Flow CRM
Summary
by MITRE • 08/10/2026
Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact's numeric identifier, because the save and export operations retrieve the record without constraining the query to the authenticated user's company.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical authorization bypass flaw in the Roskus Prospero Flow CRM system that undermines the fundamental security principle of least privilege. The issue exists within the contact management component where authenticated users can manipulate contact data belonging to other companies through direct numeric identifier access. This weakness stems from improper access control implementation where the system fails to enforce company-level boundaries during data retrieval operations, allowing malicious actors to exploit this gap for unauthorized data access and modification.
The technical implementation flaw manifests in how the save and export functions process contact records without validating whether the requesting user belongs to the same company as the target contact. This creates a scenario where any authenticated user can construct requests using numeric identifiers to access or modify contacts from other organizations, effectively bypassing the intended multi-tenant security model. The vulnerability specifically affects versions prior to 5.4.8 and demonstrates a classic case of insufficient input validation combined with inadequate authorization checks.
The operational impact of this vulnerability extends beyond simple data exposure to include potential data integrity compromises and privacy violations across multiple organizations using the same CRM instance. An attacker could systematically enumerate contact identifiers to gather personal information from various companies, potentially enabling social engineering attacks or identity theft. The ability to blindly overwrite contact data introduces risks of data corruption and operational disruption for affected organizations.
This vulnerability aligns with CWE-285, which describes improper authorization scenarios where systems fail to properly verify that authenticated users have appropriate access rights to perform requested operations. It also maps to ATT&CK technique T1078 which covers valid accounts for lateral movement and privilege escalation through unauthorized access to resources. Organizations using this CRM version face significant risk of data breaches and compliance violations under regulations such as gdpr and ccpa due to the unauthorized access to personal data.
The recommended mitigation involves implementing robust company-level access controls that validate user authorization before processing any contact management operations, specifically requiring that all queries be constrained to the authenticated user's company context. System updates to version 5.4.8 or later are essential, along with comprehensive access control audits to ensure no other components suffer from similar authorization bypass vulnerabilities. Additionally, organizations should implement logging and monitoring mechanisms to detect unauthorized access attempts and establish proper input validation procedures for all numeric identifier-based operations within the contact management system.