This vulnerability (CWE-639) exists in the Excel import functionality of Roskus Prospero Flow CRM prior to version 5.14.0. The import handlers (CustomerImport, LeadImport, ProductImport) map the company_id field directly from the uploaded spreadsheet without verifying that it matches the authenticated user's company. This allows an authenticated user from any role or company to create customer, lead, and product records within another company's tenant by submitting a specially crafted spreadsheet to the POST /customer/import/excel/save endpoint. The lack of authorization validation on the company_id field leads to an authorization bypass.

An attacker with any authenticated user role can create records in other companies' tenants, potentially leading to data integrity issues, unauthorized data insertion, and confusion in multi-tenant environments. There is no indication of data disclosure or privilege escalation beyond record creation. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), reflecting network attack vector, low complexity, and low impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Excel import functionality to trusted users only, and monitor import activities for suspicious company_id values. Avoid uploading spreadsheets with untrusted company_id data. Follow vendor updates closely for an official patch or mitigation.