PT-2026-60477

CVE-2026-59237

Published

2026-07-16

Updated

2026-07-16

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.5.3

Description An authorization bypass exists in the Order and OrderItem REST API controllers. A remote, authenticated user can read, modify, and delete orders and order items belonging to other companies (tenants) by providing a sequential numeric id to the following endpoints:

'GET /api/order/{id}'
'PUT /api/order/{id}'
'GET /api/order-item/{id}'
'PUT /api/order-item/{id}'
'DELETE /api/order-item/{id}'

This occurs because the controllers use the Order::find($id) and Item::find($id) functions to resolve records without restricting the search to the authenticated user's company.

Recommendations Update to version 5.5.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Gustavo Novaro

Secur0 Cna

Theoffsecgirl

Vendors

Affected products

Weakness enumeration