Authorization Bypass in Roskus Prospero Flow CRM

CVE-2026-59236

What is CVE-2026-59236?

An authorization bypass vulnerability exists in Roskus Prospero Flow CRM's Excel import handlers which allows a remote, authenticated user to create records in another company's tenant. This is due to the system's failure to verify that the company_id in the uploaded spreadsheet matches the authenticated user's company. As a result, attackers may exploit this vulnerability by manipulating the company_id column in the input file to gain unauthorized access to sensitive data and create records across tenants.

References