CVE-2026-78365: IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting companyid in the body.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roskus Prospero Flow CRMto a version that resolves this vulnerability.Fixed in 5.3.2 - Upgrade
Upgrade
Roskus Prospero Flow CRMto a version that resolves this vulnerability.Fixed in 5.5.3 - Operational
Review the supplier table for altered company_id values caused by cross-tenant read/modify (e.g., supplier records reassigned via PUT /api/supplier/{id} with company_id in request body).
- Operational
Rotate exposed order-portal credentials and bank details after identifying any altered supplier records.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user of the affected CRM can exploit it. The issue permits access across company boundaries, so a user from one tenant can target another company's supplier records.
What does an attacker need to do to exploit it?
The attacker needs to send a PUT request to /api/supplier/{id} for another company's supplier record and control the company_id value in the request body. This can be used to read and modify the record and reassign it to the attacker's company.
Which versions should be treated as affected?
Roskus Prospero Flow CRM versions 4.0.0 through 5.3.1 are identified as affected. Organizations running a version in that range should assess their supplier API exposure.