The vulnerability in Roskus Prospero Flow CRM before version 5.4.9 arises from improper authorization enforcement in the ticket management component. Authenticated users can bypass authorization controls by manipulating the ticket's numeric identifier (company_id). Read and save operations do not constrain queries to the user's company, allowing access to full ticket content (title, description, attachments) of other companies. The delete controller uses a generic request type instead of a specialized request that enforces permissions, enabling deletion of tickets from other companies without authorization. This is classified as CWE-862 (Missing Authorization).

Exploitation of this vulnerability allows an authenticated user from one company to read sensitive ticket information, hijack tickets by changing their company association, and delete tickets belonging to other companies. This leads to unauthorized data disclosure, data integrity compromise, and potential denial of service for affected companies' ticket records.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the ticket management component to trusted users and monitor for suspicious activity related to ticket access and modification.