The vulnerability in Roskus Prospero Flow CRM before version 5.4.7 is due to missing authorization checks in the product management component. Specifically, ProductUpdateController does not extend MainController, resulting in no authentication check on the read endpoint. Additionally, ProductRepository::save() retrieves product records without constraining queries to the authenticated user's company, allowing an attacker to read and hijack products by reassigning their company_id. This constitutes an authorization bypass (CWE-639) that exposes sensitive product data and allows unauthorized modification.

Authenticated users from any company can read sensitive product information of other companies, including price, cost, stock, SKU, and barcode. They can also hijack products by changing the company_id, effectively taking control of products they do not own. This compromises data confidentiality and integrity across company boundaries within the CRM.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected product management endpoints and monitor for unauthorized access attempts. Review and enforce proper authorization checks in the ProductUpdateController and ensure product queries are constrained by the authenticated user's company context.