Is CVE-2026-19539 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19539 being exploited in the wild.

How severe is CVE-2026-19539?

Informational severity, with a CVSS score of 8.3, published 11 August 2026.

Which products and versions are affected?

Roskus Prospero Flow CRM before 5.4.9.

Is there a fix for CVE-2026-19539?

A patch was published on 2026-06-25: Fix released in v5.4.9 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19539 attacked?

It is attacked over the network.

Am I affected by CVE-2026-19539?

Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19539: Roskus Prospero Flow CRM authorization bypass in ticket management

CVE-2026-19539 · Severity: info · CVSS 8.3 · Published 2026-08-11

Prospero Flow CRM is a customer relationship management platform used to track support tickets and customer interactions across companies. Authenticated users can read, modify, and delete tickets belonging to other companies due to missing authorization checks, potentially exposing sensitive customer data, disrupting ticket workflows, and allowing malicious actors to hijack or destroy another company's support records.

Technologies: Roskus Prospero Flow CRM. Vendors: Roskus.

Quick answers

Is CVE-2026-19539 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19539 being exploited in the wild.
How severe is CVE-2026-19539?: Informational severity, with a CVSS score of 8.3, published 11 August 2026.
Which products and versions are affected?: Roskus Prospero Flow CRM before 5.4.9.
Is there a fix for CVE-2026-19539?: A patch was published on 2026-06-25: Fix released in v5.4.9 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19539 attacked?: It is attacked over the network.
Am I affected by CVE-2026-19539?: Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a broken access control vulnerability (authorization bypass) affecting the ticket management component. The root cause stems from three issues: the TicketUpdateController and TicketRepository do not filter tickets by the authenticated user's company_id when reading or updating, allowing cross-tenant data access and tenant hijacking; the TicketDeleteController uses a generic Illuminate\Http\Request type hint instead of the TicketDeleteRequest that would enforce permission checks, bypassing authorization entirely. An authenticated user from any company can read complete ticket content (title, description, attachments) from other companies via the numeric ticket identifier, reassign another company's tickets by modifying the company_id field, or delete tickets without authorization via GET requests to /ticket/delete/{id}. The vulnerability requires authentication but no elevated privileges. Patches are available in version 5.4.9 and later (released June 2026), which add company_id filtering and proper authorization checks.

Affected products

Roskus Prospero Flow CRM before 5.4.9

Timeline

2026-08-11: disclosed
2026-06-25: patched: Fix released in v5.4.9 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.