Threats Tagged 'cve-2026-19734'

CVE-2026-19734 is a vulnerability in Roskus Prospero Flow CRM before version 5.4.7 involving missing authorization checks in the product management component. Authenticated users from any company can read sensitive product data of other companies and hijack products by reassigning their company_id due to improper access control. This occurs because the ProductUpdateController lacks proper authentication enforcement and the product save operation does not restrict queries to the authenticated user's company.

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and to hijack that product by reassigning its company_id, via the product's numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data['id'])` without constraining the query to the authenticated user's company before overwriting its company_id.