The human resources component of Roskus Prospero Flow CRM versions prior to 5.15.9 contains a hard-coded credential vulnerability (CWE-798). Specifically, the employee save controller falls back to a fixed password "changeme" because the onboarding form does not provide a password field. This flaw allows unauthenticated remote attackers to authenticate as any employee who has been onboarded through the standard process by supplying only the employee's email address. This issue affects all versions before 5.15.9. No patch links are provided, and no vendor advisory is referenced, so patch status is not confirmed.

This vulnerability allows unauthenticated remote attackers to impersonate any onboarded employee by using a hard-coded password, potentially leading to unauthorized access to employee accounts and sensitive information within the CRM system. The impact is critical due to the ease of exploitation (no authentication required) and the high level of access gained.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component and monitor for suspicious authentication attempts involving the fallback password. Avoid using or deploying versions prior to 5.15.9 if possible.