CVE-2026-78365: fallo crítico en Roskus Prospero Flow CRM
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 0.5%
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
Roskus · Prospero Flow CRMCVEs relacionadas — Roskus Prospero Flow CRM
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-59239HIGHStored XSS in Prospero Flow CRM email body allows administrator account takeoverEPSS 0.7%CVE-2026-59235HIGHMissing authorization in Prospero Flow CRM allows low-privileged users to read all bank accountsEPSS 0.7%CVE-2026-59237MEDIUMIDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of ordersEPSS 0.6%CVE-2026-59236MEDIUMAuthorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injectionEPSS 0.6%CVE-2026-59234MEDIUMAuthorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletionEPSS 0.6%CVE-2026-19734HIGHIDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijackingEPSS 0.6%