Is CVE-2026-59236 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59236 being exploited in the wild.

How severe is CVE-2026-59236?

Informational severity, with a CVSS score of 6.9, published 15 July 2026.

Which products and versions are affected?

Roskus Prospero Flow CRM 1.0.0 to 5.13.9.

Is there a fix for CVE-2026-59236?

A patch was published on 2026-07-15: Version 5.14.0 released with the fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59236 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59236?

Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59236: Roskus Prospero Flow CRM authorization bypass in Excel import

CVE-2026-59236 · Severity: info · CVSS 6.9 · Published 2026-07-15

Prospero Flow CRM, a customer relationship management platform, contains a security flaw in its Excel data import feature. An authorized user from one company can create fake customer, lead, or product records in another company's private account by manipulating the company ID in an uploaded spreadsheet. This could lead to data corruption, incorrect business metrics, and unauthorized data injection across different organizations using the same system.

Technologies: Roskus Prospero Flow CRM. Vendors: Roskus.

Quick answers

Is CVE-2026-59236 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59236 being exploited in the wild.
How severe is CVE-2026-59236?: Informational severity, with a CVSS score of 6.9, published 15 July 2026.
Which products and versions are affected?: Roskus Prospero Flow CRM 1.0.0 to 5.13.9.
Is there a fix for CVE-2026-59236?: A patch was published on 2026-07-15: Version 5.14.0 released with the fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59236 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59236?: Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability, classified as CWE-639, exists in the Excel import handlers (CustomerImport, LeadImport, and ProductImport) of Prospero Flow CRM. The application fails to validate the 'company_id' field provided within uploaded Excel files against the authenticated user's actual session data. By submitting a POST request to /customer/import/excel/save (or equivalent lead/product endpoints) with a spreadsheet containing a victim's company_id, an attacker can inject arbitrary records into that tenant. The vulnerability is particularly impactful because company IDs are incremental integers, making victim tenants easy to enumerate. The issue was resolved in version 5.14.0 by forcing the use of the authenticated user's company ID during the import process.

Affected products

Roskus Prospero Flow CRM 1.0.0 to 5.13.9

Timeline

2026-07-15: advisory: Secur0 published the vulnerability details.
2026-07-15: patched: Version 5.14.0 released with the fix.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.