This vulnerability (CWE-862) in the ticket management component of Roskus Prospero Flow CRM before version 5.4.9 enables authenticated users to bypass authorization controls. Specifically, users can read full ticket contents (including title, description, and attachments) of other companies, reassign tickets to different companies by modifying the company_id, and delete tickets belonging to other companies. The root cause is that read and save operations retrieve ticket records without constraining queries to the user's company context, and the delete controller uses a generic request type instead of a specialized request that enforces permission checks.

Exploitation of this vulnerability allows unauthorized access to sensitive ticket data across company boundaries, unauthorized modification of ticket ownership, and unauthorized deletion of tickets. This can lead to data leakage, disruption of ticket management workflows, and potential loss of critical information. The CVSS 4.0 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality and integrity.

No official patch or remediation guidance has been provided yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected versions and monitor for suspicious activity related to ticket management. Avoid using affected versions in production environments if possible.