Theoffsecgirl

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.5.3 **Description** An authorization bypass exists in the Order and OrderItem REST API controllers. A remote, authenticated user can read, modify, and delete orders and order items belonging to other companies (tenants) by providing a sequential numeric `id` to the following endpoints: - 'GET /api/order/{id}' - 'PUT /api/order/{id}' - 'GET /api/order-item/{id}' - 'PUT /api/order-item/{id}' - 'DELETE /api/order-item/{id}' This occurs because the controllers use the `Order::find($id)` and `Item::find($id)` functions to resolve records without restricting the search to the authenticated user's company. **Recommendations** Update to version 5.5.3.