This vulnerability in Roskus Prospero Flow CRM affects versions 4.0.0 up to but not including 5.3.2. It involves an authorization bypass through a user-controlled key in the supplier API. Specifically, an authenticated user can send a PUT request to /api/supplier/{id} with a modified company_id in the request body, enabling unauthorized access to supplier records of other companies and the ability to reassign those records to their own company. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Exploitation of this vulnerability allows an authenticated user to bypass authorization controls, read and modify supplier records of other companies, and reassign those records to their own company. This can lead to unauthorized data disclosure and data integrity violations within the CRM system, potentially impacting business operations and trust between companies using the platform.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a patch is available, restrict authenticated user permissions to limit access to supplier API endpoints if possible and monitor for suspicious activity related to supplier record modifications.