Roskus Prospero Flow CRM up to 5.4.8 Ticket Management authorization

Summaryinfo

A vulnerability was found in Roskus Prospero Flow CRM up to 5.4.8 and classified as critical. Impacted is an unknown function of the component Ticket Management. The manipulation results in authorization. This vulnerability is known as CVE-2026-19539. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Roskus Prospero Flow CRM up to 5.4.8. It has been classified as critical. Affected is an unknown code of the component Ticket Management. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content (title, description, and attachments) of tickets belonging to another company, to hijack another company's tickets by reassigning their company_id, and to delete another company's tickets without any authorization check, via the ticket's numeric identifier, because the read and save operations retrieve the record without constraining the query to the authenticated user's company, and the delete controller type-hints a generic Illuminate\Http\Request instead of the TicketDeleteRequest that would enforce the required permission.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-19539 since 08/11/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are neither technical details nor an exploit publicly available.

Upgrading to version 5.4.9 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Customer Relationship Management System

Vendor

• Roskus

Name

• Prospero Flow CRM

Version

• 5.4.0
• 5.4.1
• 5.4.2
• 5.4.3
• 5.4.4
• 5.4.5
• 5.4.6
• 5.4.7
• 5.4.8

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion