CVE-2026-19433

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.4.8

Description An authorization bypass exists in the contact management component. Authenticated users can overwrite contact data belonging to other companies or download personal data as a vCard by manipulating the contact's numeric identifier. This occurs because the save and export operations retrieve records without restricting the query to the company associated with the authenticated user.

Recommendations Update Roskus Prospero Flow CRM to version 5.4.8 or later.