Authorization Bypass Vulnerability in Roskus Prospero Flow CRM

CVE-2026-19433

What is CVE-2026-19433?

An authorization bypass vulnerability exists in the contact management component of Roskus Prospero Flow CRM versions prior to 5.4.8. This flaw allows authenticated users from one company to manipulate and overwrite contact data belonging to another company. The vulnerability arises from insufficient query constraints during save and export operations, enabling the unauthorized retrieval and export of personal data as a vCard using the numeric identifier of the contact. This issue can lead to significant data privacy risks.

References