Authorization Bypass in Roskus Prospero Flow CRM Allows Unrestricted Ticket Access

CVE-2026-19539

What is CVE-2026-19539?

The ticket management component in Roskus Prospero Flow CRM prior to version 5.4.9 suffers from an authorization bypass vulnerability. This issue permits authenticated users from any company to access full ticket content of other companies, including sensitive data such as titles, descriptions, and attachments. Additionally, users can hijack tickets belonging to other companies by manipulating the company_id or can delete these tickets without adequate authorization checks. The exploitation occurs due to query operations that fail to restrict data access based on the user's company constraints, compounded by the delete operation's inadequate permission enforcement.

References