Roskus Prospero Flow Crm
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Roskus Prospero Flow Crm.
By the Year
In 2026 there have been 15 vulnerabilities in Roskus Prospero Flow Crm with an average score of 8.3 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 15 | 8.30 |
It may take a day or so for new Prospero Flow Crm vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Roskus Prospero Flow Crm Security Vulnerabilities
Prospero Flow CRM Auth Bypass via /transaction/save 4.9.1-5.14.0
CVE-2026-77780
5.3 - Medium
- August 21, 2026
Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a bank_account_id or bank_card_id belonging to that company in POST /transaction/save, which is persisted and rendered without any company ownership check.
Insecure Direct Object Reference / IDOR
Auth Bypass in Roskus Prospero Flow CRM 5.0.05.3.5 Transaction API
CVE-2026-77759
8.7 - High
- August 21, 2026
Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check.
Insecure Direct Object Reference / IDOR
Hard-coded Creds in Prospero Flow CRM HR Before 5.15.9 Allows Unauth Remote Auth
CVE-2026-19871
9.3 - Critical
- August 14, 2026
Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.
Use of Hard-coded Credentials
Payroll Auth Bypass in Roskus Prospero Flow CRM Pre-5.15.10
CVE-2026-19870
8.6 - High
- August 14, 2026
Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the instance, and users holding the create payroll permission to create payroll records attributed to another company's employees, because the listing query is not scoped to the caller's company and the employee identifier is validated for global existence rather than company membership
Insecure Direct Object Reference / IDOR
Roskus Prospero Flow CRM <5.4.7 Auth Bypass via ProductUpdateController
CVE-2026-19734
8.6 - High
- August 13, 2026
Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and to hijack that product by reassigning its company_id, via the product's numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data['id'])` without constraining the query to the authenticated user's company before overwriting its company_id.
Insecure Direct Object Reference / IDOR
Auth Bypass via User-Control Key in Ticket Mgmt of Roskus Prospero 5.4.9
CVE-2026-19539
8.6 - High
- August 11, 2026
Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content (title, description, and attachments) of tickets belonging to another company, to hijack another company's tickets by reassigning their company_id, and to delete another company's tickets without any authorization check, via the ticket's numeric identifier, because the read and save operations retrieve the record without constraining the query to the authenticated user's company, and the delete controller type-hints a generic Illuminate\Http\Request instead of the TicketDeleteRequest that would enforce the required permission.
AuthZ
Prospero Flow CRM auth bypass via user-controlled key (pre5.4.8)
CVE-2026-19433
8.6 - High
- August 10, 2026
Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact's numeric identifier, because the save and export operations retrieve the record without constraining the query to the authenticated user's company.
Insecure Direct Object Reference / IDOR
Roskus Prospero Flow CRM <5.2.1: Auth Bypass in Permission Allows Role Escalation
CVE-2026-59233
8.7 - High
- August 10, 2026
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.
Insecure Direct Object Reference / IDOR
CVE-2026-59232: XSS via unescaped lead name in Prospero Flow CRM <5.3.7
CVE-2026-59232
- July 31, 2026
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.
XSS
IDOR in DeleteNotificationController allows cross-user deletion in PHP web app
CVE-2026-59240
- July 27, 2026
The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system. The controller retrieves the target record with `Notification::findOrFail($id)` and deletes it without validating `user_id` or `company_id` ownership, unlike the sibling `SetNotificationReadAjaxController`, which correctly scopes lookups by `Auth::id()`. Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events.
Insecure Direct Object Reference / IDOR
Roskus Prospero Flow CRM <5.4.4: Stored XSS via Email Body
CVE-2026-59239
- July 27, 2026
Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload stored in an email body that is persisted without sanitization and rendered unescaped with {!! $email->body !!} when the recipient opens the message.
XSS
Roskus Prospero Flow CRM 5.5.3 Auth Bypass via {id} in Order API
CVE-2026-59237
- July 16, 2026
Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company (tenant) via a sequential numeric {id} supplied to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or DELETE /api/order-item/{id}, because the controllers resolve records with Order::find($id) / Item::find($id) without scoping by the authenticated user's company.
Insecure Direct Object Reference / IDOR
Prospero Flow CRM <5.14 Auth Bypass via Excel Import
CVE-2026-59236
- July 15, 2026
Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company's tenant via a spreadsheet whose company_id column points to the victim tenant, uploaded to POST /customer/import/excel/save, which maps company_id directly from the file and performs no check that it matches the authenticated user's company.
Insecure Direct Object Reference / IDOR
Prospero Flow CRM <5.5.3 API Missing Auth: Remote Reads Bank Data
CVE-2026-59235
- July 15, 2026
Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php), exposed at GET /api/bank-account, in Prospero Flow CRM <5.5.3, which allows a remote, authenticated attacker holding a low-privileged role (e.g. the "User"/"Usuario" role) to read arbitrary bank account records belonging to their company by sending an authenticated request to the endpoint with a valid bearer token, because the API route is protected only by the auth:api middleware and carries no permission gate, unlike the equivalent web route, which enforces can('read bank'), and the handler resolves records with Account::where('company_id', Auth::user()->company_id)->get(), performing only company scoping and no role or permission check before returning the data. This results in the unauthorized disclosure of sensitive banking information (e.g. IBAN, SWIFT/BIC, account identifiers) to users who should not have access to it.
Insecure Direct Object Reference / IDOR
Prospero Flow CRM 5.5.3-Auth Bypass in CalendarDeleteEventController
CVE-2026-59234
- July 03, 2026
Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at GET /calendar/event/delete/{id}, in Prospero Flow CRM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary calendar events belonging to other users by manipulating the {id} path parameter, because the delete handler resolves the record with Calendar::find($id)->delete() and performs no ownership check (no user_id/company_id scoping) before deletion. This results in unauthorized destruction of other users' calendar events across the platform.
Insecure Direct Object Reference / IDOR
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Roskus Prospero Flow Crm or by Roskus? Click the Watch button to subscribe.
