This vulnerability (CWE-798) affects the human resources component of Roskus Prospero Flow CRM prior to version 5.15.9. The system uses a hard-coded fallback password "changeme" for employee accounts created through the standard onboarding flow, which lacks a password field. As a result, attackers can authenticate remotely and unauthenticated by supplying only an employee's email address, gaining access as that employee. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity.

An unauthenticated remote attacker can impersonate any employee onboarded through the standard flow by using the hard-coded password "changeme". This leads to unauthorized access to employee accounts, compromising confidentiality and integrity of sensitive information within the CRM system. The vulnerability does not require any privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict network access to the affected component and consider implementing compensating controls such as additional authentication mechanisms or disabling the vulnerable onboarding feature if possible.