CVE-2026-114519

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions 2.0.0 through 5.25.0

Description An authorization flaw in the user API allows a user with a basic role to access accounts of other users within the same company, including those with higher privileges. In versions 3.5.0 and later, this also allows the deletion of such accounts. The issue exists because the endpoints 'GET /api/user/{id}' and 'DELETE /api/user/{id}' only verify the validity of a JSON Web Token via the auth:api middleware without checking specific permissions, policies, or roles in the UserReadController::read() and UserDeleteController::delete() functions. While access is generally scoped by company, the deletion process bypasses company verification if the authenticated user belongs to Company::DEFAULT COMPANY, enabling a basic user in that company to delete any account across the entire installation. This can lead to the exposure of personal data, such as email addresses, telephone numbers, postal addresses, and IBANs, and the potential removal of the last administrative account of a company.

Recommendations Update Roskus Prospero Flow CRM to version 5.26.0 or later. As a temporary workaround, restrict access to the 'GET /api/user/{id}' and 'DELETE /api/user/{id}' endpoints.