Threats affecting pkg:github/roskus/prospero-flow-crm

An authorization bypass vulnerability exists in the supplier API of Roskus Prospero Flow CRM versions 4.0.0 through 5.3.1. This flaw allows any authenticated user to read and modify supplier records belonging to other companies and to reassign those records to their own company by manipulating the company_id field in a PUT request to /api/supplier/{id}.

An authorization bypass vulnerability exists in Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5. An authenticated user can access transactions belonging to other companies on the same instance by incrementing the transaction identifier in the API endpoint GET /api/transaction/{id}. This occurs because the transaction API does not enforce company scoping or perform permission checks on the requested transaction ID.

An authorization bypass vulnerability exists in the payroll module of Roskus Prospero Flow CRM versions before 5.15.10. Authenticated users with read payroll permission can view salary and banking details of employees from other companies within the same instance. Additionally, users with create payroll permission can create payroll records for employees of other companies. This occurs because the query listing is not properly scoped to the caller's company, and employee identifiers are validated only for global existence rather than company membership.

CVE-2026-19734 is a vulnerability in Roskus Prospero Flow CRM before version 5.4.7 involving missing authorization checks in the product management component. Authenticated users from any company can read sensitive product data of other companies and hijack products by reassigning their company_id due to improper access control. This occurs because the ProductUpdateController lacks proper authentication enforcement and the product save operation does not restrict queries to the authenticated user's company.