Authorization Bypass in Roskus Prospero Flow CRM Affects Sensitive Data Access

CVE-2026-19734

What is CVE-2026-19734?

The Prospero Flow CRM by Roskus contains a vulnerability in its product management component that permits authenticated users to access sensitive data across different companies. This is due to a missing authorization check in the ProductUpdateController, allowing users to view critical information such as pricing and inventory for products not owned by their company. Additionally, the flaw enables attackers to hijack products by altering their company_id using the product's identifier, a consequence of the inadequate oversight in query constraints during product data retrieval.

References