This vulnerability (CVE-2026-19433) in Roskus Prospero Flow CRM prior to 5.4.8 involves an authorization bypass through a user-controlled key in the contact management component. Authenticated users can exploit this flaw to overwrite contact data belonging to other companies and export that data as vCards by using the contact's numeric identifier. The root cause is that the save and export operations retrieve contact records without constraining the query to the authenticated user's company, allowing cross-company data access and modification.

An attacker with authenticated access to the CRM can overwrite contact information of other companies and download sensitive personal contact data, potentially leading to data integrity issues and unauthorized data disclosure. This compromises confidentiality and integrity of contact data across company boundaries within the CRM.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the contact management component to trusted users only and monitor for suspicious activity related to contact data modification and export.