Skip to contentRoskus Prospero Flow Crm vulnerabilities
- roskus prospero flow crmMissing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accountsCVE-2026-1145198.6 High
- roskus prospero flow crmCSRF in Prospero Flow CRM order confirmation allows unauthorized order state changesCVE-2026-829115.1 Medium
- roskus prospero flow crmUnrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scriptingCVE-2026-819314.8 Medium
- roskus prospero flow crmIDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modificationCVE-2026-783659.3 Critical
- roskus prospero flow crmUnrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVGCVE-2026-783374.8 Medium
- roskus prospero flow crmUnvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiersCVE-2026-777805.3 Medium
- roskus prospero flow crmIDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial recordsCVE-2026-777598.7 High
- roskus prospero flow crmUse of hard-coded credentials in Prospero Flow CRM employee onboardingCVE-2026-198719.3 Critical
- roskus prospero flow crmIDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creationCVE-2026-198708.6 High
- roskus prospero flow crmIDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijackingCVE-2026-197348.6 High
- roskus prospero flow crmIDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletionCVE-2026-195398.6 High
- roskus prospero flow crmAuthorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard exportCVE-2026-194338.6 High
- roskus prospero flow crmMissing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalationCVE-2026-592338.7 High
- roskus prospero flow crmStored Cross-site Scripting in Prospero Flow CRM lead name fieldCVE-2026-592325.3 Medium
- roskus prospero flow crmIDOR in Prospero Flow CRM allows deletion of other users' notificationsCVE-2026-592406.9 Medium
- roskus prospero flow crmStored XSS in Prospero Flow CRM email body allows administrator account takeoverCVE-2026-592398.6 High
- roskus prospero flow crmIDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of ordersCVE-2026-592376.9 Medium
- roskus prospero flow crmAuthorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injectionCVE-2026-592366.9 Medium
- roskus prospero flow crmMissing authorization in Prospero Flow CRM allows low-privileged users to read all bank accountsCVE-2026-592358.7 High
- roskus prospero flow crmAuthorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletionCVE-2026-592346.9 Medium