Authorization Bypass in Roskus Prospero Flow CRM Affects Multiple Versions

CVE-2026-78365

What is CVE-2026-78365?

The Roskus Prospero Flow CRM has a security vulnerability that allows authenticated users to bypass authorization controls through user-controlled keys in the supplier API. This flaw enables users to read, modify, and reassign supplier records belonging to other companies by sending a PUT request to the endpoint /api/supplier/{id} with an altered company_id. This manipulation poses significant risks for data privacy and integrity, making it crucial for users to adopt robust security measures to prevent exploitation.

References