Executive brief
Roskus Prospero Flow CRM is a customer relationship management system used to manage business contacts and suppliers. An authenticated user can exploit an authorization flaw to read, modify, and reassign other companies' supplier records to their own account, compromising data integrity and enabling fraudulent supplier takeover across tenants.
Technical details
The vulnerability is a mass assignment flaw in the supplier API endpoint /api/supplier/{id} that fails to restrict modification of the company_id field. An authenticated attacker can send a PUT request with an arbitrary company_id value in the request body, allowing them to reassign supplier records belonging to other organizations. The root cause is insufficient input validation and use of $request->all() instead of $request->validated() in the SupplierUpdateController. The attack requires authentication but no additional privileges; any logged-in user can exploit it. A patch was released in version 5.5.3 that adds company_id scoping and replaces unsafe request handling with proper validation.
Affected products
- Roskus Prospero Flow CRM 4.0.0 through 5.3.1
Timeline
- 2026-08-24: disclosed
- 2026-06-26: patched: Version 5.5.3 released with fix