by Kastro
Paper/Archive/CVE-2026-78365

CVE-2026-78365

Roskus Prospero Flow CRM — IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 43.5.435 × 208.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.

Affected

ProductAffectedFixed inSource
Prospero Flow CRM4.0.0 – < 5.3.25.3.2CNA

Scores by source

Secur0 (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchgithub.com/Roskus/prospero-flow-crm/commit/4a52477e6ed66afa436814c80e7bcd68670dd596refgithub.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3writeupsecur0.com/en/cna/cve-list/cve-2026-78365-idor-supplier-api-cross-tenant-update