Threats tagged 'ghsa-2wg2-5v89-cgh7'

An authorization bypass vulnerability exists in the ticket management component of Roskus Prospero Flow CRM versions before 5.4.9. Authenticated users from any company can access, modify, and delete tickets belonging to other companies without proper authorization checks. This occurs because the system fails to restrict ticket operations to the authenticated user's company context, allowing unauthorized access via the ticket's numeric identifier.