PT-2026-60108

CVE-2026-59236

Published

2026-07-15

Updated

2026-07-15

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.14.0

Description An authorization bypass exists in the Excel import handlers (CustomerImport, LeadImport, and ProductImport). A remote, authenticated user can create customer, lead, and product records within another company's tenant by uploading a spreadsheet to the POST '/customer/import/excel/save' endpoint. The system maps the company id variable directly from the uploaded file without verifying if it matches the authenticated user's company, allowing the company id to be controlled by the user.

Recommendations Update Roskus Prospero Flow CRM to version 5.14.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Gustavo Novaro

Secur0 Cna

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key