Roskus Prospero Flow CRM up to 5.25.x User API routes/api.php delete id authorization

Summaryinfo

A vulnerability was found in Roskus Prospero Flow CRM up to 5.25.x. It has been declared as critical. This impacts the function UserReadController::read/UserDeleteController::delete of the file routes/api.php of the component User API. Executing a manipulation of the argument ID can lead to authorization. This vulnerability appears as CVE-2026-114519. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Roskus Prospero Flow CRM up to 5.25.x. This vulnerability affects the function UserReadController::read/UserDeleteController::delete of the file routes/api.php of the component User API. The manipulation of the argument id with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-114519 since 10/21/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

By approaching the search of inurl:routes/api.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.26.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Customer Relationship Management System

Vendor

• Roskus

Name

• Prospero Flow CRM

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.11
• 5.12
• 5.13
• 5.14
• 5.15
• 5.16
• 5.17
• 5.18
• 5.19
• 5.20
• 5.21
• 5.22
• 5.23
• 5.24
• 5.25

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion