CVE-2026-59236

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.14.0

Description An authorization bypass exists in the Excel import handlers (CustomerImport, LeadImport, and ProductImport). A remote, authenticated user can create customer, lead, and product records within another company's tenant by uploading a spreadsheet to the POST '/customer/import/excel/save' endpoint. The system maps the company id variable directly from the uploaded file without verifying if it matches the authenticated user's company, allowing the company id to be controlled by the user.

Recommendations Update Roskus Prospero Flow CRM to version 5.14.0 or later.