Quick answers
- Is CVE-2026-78365 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78365 being exploited in the wild.
- How severe is CVE-2026-78365?
- Informational severity, published 24 August 2026.
- Which products and versions are affected?
- Roskus Prospero Flow CRM 4.0.0 through 5.3.1.
- Is there a fix for CVE-2026-78365?
- A patch was published on 2026-06-26: Version 5.5.3 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78365 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-78365?
- Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a mass assignment flaw in the supplier API endpoint /api/supplier/{id} that fails to restrict modification of the company_id field. An authenticated attacker can send a PUT request with an arbitrary company_id value in the request body, allowing them to reassign supplier records belonging to other organizations. The root cause is insufficient input validation and use of $request->all() instead of $request->validated() in the SupplierUpdateController. The attack requires authentication but no additional privileges; any logged-in user can exploit it. A patch was released in version 5.5.3 that adds company_id scoping and replaces unsafe request handling with proper validation.
Affected products
- Roskus Prospero Flow CRM 4.0.0 through 5.3.1
Timeline
- 2026-08-24: disclosed
- 2026-06-26: patched: Version 5.5.3 released with fix