CVE-2026-19734

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.4.7

Description An authorization bypass exists in the product management component. Authenticated users can access sensitive data, including price, cost, stock, SKU, and barcode, belonging to other companies. Additionally, users can hijack products by reassigning the company id using the product's numeric identifier. This occurs because the ProductUpdateController does not extend MainController, resulting in a lack of authentication checks on the read endpoint. Furthermore, the ProductRepository::save() function uses Product::find($data['id']) to retrieve records without verifying if the product belongs to the authenticated user's company before updating the company id variable.

Recommendations Update Roskus Prospero Flow CRM to version 5.4.7 or later.