CVE-2026-78365: CWE-639 Authorization bypass through User-Controlled key in Roskus Prospero Flow CRM

This vulnerability (CVE-2026-78365) affects Roskus Prospero Flow CRM from version 4.0.0 up to but not including 5.3.2. It involves an authorization bypass through a user-controlled key in the supplier API. Specifically, an authenticated user can send a PUT request to /api/supplier/{id} with a modified company_id in the request body, enabling unauthorized access to supplier records of other companies and the ability to reassign those records to the attacker's company. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

An attacker with any authenticated access can read and modify supplier records of other companies, potentially leading to unauthorized data disclosure and data tampering. They can also reassign supplier records to their own company, which may cause data integrity issues and business process disruptions. This compromises the confidentiality and integrity of supplier data within the affected CRM system.

Patch status is not yet confirmed — no official fix or remediation level has been provided by the vendor. Users should monitor the vendor's advisory for updates and apply any official patches once available. Until then, restrict authenticated user permissions to the minimum necessary and consider additional access controls or API request validations to mitigate unauthorized modifications.