CVE-2026-19734 is a vulnerability in Roskus Prospero Flow CRM before version 5.4.7 involving missing authorization checks in the product management component. Authenticated users from any company can read sensitive product data of other companies and hijack products by reassigning their company_id due to improper access control. This occurs because the ProductUpdateController lacks proper authentication enforcement and the product save operation does not restrict queries to the authenticated user's company.