Executive brief
Prospero Flow CRM is a customer relationship management platform used to track support tickets and customer interactions across companies. Authenticated users can read, modify, and delete tickets belonging to other companies due to missing authorization checks, potentially exposing sensitive customer data, disrupting ticket workflows, and allowing malicious actors to hijack or destroy another company's support records.
Technical details
This is a broken access control vulnerability (authorization bypass) affecting the ticket management component. The root cause stems from three issues: the TicketUpdateController and TicketRepository do not filter tickets by the authenticated user's company_id when reading or updating, allowing cross-tenant data access and tenant hijacking; the TicketDeleteController uses a generic Illuminate\Http\Request type hint instead of the TicketDeleteRequest that would enforce permission checks, bypassing authorization entirely. An authenticated user from any company can read complete ticket content (title, description, attachments) from other companies via the numeric ticket identifier, reassign another company's tickets by modifying the company_id field, or delete tickets without authorization via GET requests to /ticket/delete/{id}. The vulnerability requires authentication but no elevated privileges. Patches are available in version 5.4.9 and later (released June 2026), which add company_id filtering and proper authorization checks.
Affected products
- Roskus Prospero Flow CRM before 5.4.9
Timeline
- 2026-08-11: disclosed
- 2026-06-25: patched: Fix released in v5.4.9 and later