This vulnerability arises from missing authorization and authorization bypass in the product management component of Roskus Prospero Flow CRM versions prior to 5.4.7. The ProductUpdateController does not extend the MainController, resulting in no authentication checks on the read endpoint. Additionally, ProductRepository::save() retrieves product records without constraining queries to the authenticated user's company, allowing an attacker to read sensitive data such as price, cost, stock, SKU, and barcode of other companies' products and to hijack those products by changing their company_id via the product's numeric identifier.

Authenticated users from any company can access sensitive product information belonging to other companies, including price, cost, stock, SKU, and barcode. They can also hijack products by reassigning the company_id, potentially leading to unauthorized data exposure and manipulation of product ownership within the CRM system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the product management component to trusted users only and monitor for suspicious activity related to product data access and modification.