PT-2026-60477 · Roskus+1 · Prospero Flow Crm
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Roskus Prospero Flow CRM versions prior to 5.5.3
Description
An authorization bypass exists in the Order and OrderItem REST API controllers. A remote, authenticated user can read, modify, and delete orders and order items belonging to other companies (tenants) by providing a sequential numeric
id to the following endpoints:- 'GET /api/order/{id}'
- 'PUT /api/order/{id}'
- 'GET /api/order-item/{id}'
- 'PUT /api/order-item/{id}'
- 'DELETE /api/order-item/{id}'
This occurs because the controllers use the
Order::find($id) and Item::find($id) functions to resolve records without restricting the search to the authenticated user's company.Recommendations
Update to version 5.5.3.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Prospero Flow Crm