Executive brief
Roskus Prospero Flow CRM is a contact relationship management platform used by businesses to store and manage customer and supplier information. The vulnerability allows any authenticated user to illegally access and modify contact records belonging to other companies, as well as download sensitive personal data without proper permission checks. This can result in unauthorized data access, customer information theft, and potential database corruption across multiple organizations.
Technical details
This is an authorization bypass vulnerability in the contact management component caused by insufficient access control checks. The vulnerability exists in the ContactRepository::save() and ContactExportVCard::export() functions, which retrieve and modify contact records without filtering by the authenticated user's company_id. An authenticated user can craft requests with arbitrary contact numeric identifiers to overwrite contact data (name, phone, email, job title, notes) belonging to other companies, or export contacts as vCard files to exfiltrate personally identifiable information (PII). The vulnerability requires authentication but allows blind writes and information disclosure of other organizations' data. The fix filters queries by company_id to enforce proper tenant isolation; patches were released in version 5.4.8 and later.
Affected products
- Roskus Prospero Flow CRM before 5.4.8
Timeline
- 2026-08-10: disclosed
- 2026-06-25: patched: Fix committed to repository; version 5.4.8 and later contain the patch