Executive brief
Prospero Flow CRM, a customer relationship management platform, contains a security flaw in its Excel data import feature. An authorized user from one company can create fake customer, lead, or product records in another company's private account by manipulating the company ID in an uploaded spreadsheet. This could lead to data corruption, incorrect business metrics, and unauthorized data injection across different organizations using the same system.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability, classified as CWE-639, exists in the Excel import handlers (CustomerImport, LeadImport, and ProductImport) of Prospero Flow CRM. The application fails to validate the 'company_id' field provided within uploaded Excel files against the authenticated user's actual session data. By submitting a POST request to /customer/import/excel/save (or equivalent lead/product endpoints) with a spreadsheet containing a victim's company_id, an attacker can inject arbitrary records into that tenant. The vulnerability is particularly impactful because company IDs are incremental integers, making victim tenants easy to enumerate. The issue was resolved in version 5.14.0 by forcing the use of the authenticated user's company ID during the import process.
Affected products
- Roskus Prospero Flow CRM 1.0.0 to 5.13.9
Timeline
- 2026-07-15: advisory: Secur0 published the vulnerability details.
- 2026-07-15: patched: Version 5.14.0 released with the fix.