CVE-2026-114519 is a missing authorization vulnerability in Roskus Prospero Flow CRM versions from 2.0.0 up to but not including 5.26.0. It allows users with a basic role to read account details of other users within their company and, from version 3.5.0 onward, to delete those accounts. The vulnerability arises because the API routes for reading and deleting users only validate the JSON Web Token but do not enforce permission checks. Notably, users in the default company can delete any account across companies. This can lead to unauthorized access to personal data and deletion of accounts, including administrative ones.
Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.
CVE-2026-81931 is a medium severity vulnerability in Roskus Prospero Flow CRM versions prior to 5.16.0. It allows an authenticated user with create product permission to upload files with dangerous types, leading to stored cross-site scripting (XSS) via arbitrary JavaScript execution. The vulnerability arises because the product photo upload feature validates files only by magic bytes and rejects a fixed list of PHP extensions, but uses the client-supplied file extension when storing the file in the public web root. This enables an attacker to upload a file that starts with an image header but has an HTML extension, which is served as text/html and executes script in the application origin.
CVE-2026-78365 is a critical authorization bypass vulnerability in Roskus Prospero Flow CRM versions 4.0.0 through 5.3.1. It allows any authenticated user to read and modify supplier records belonging to other companies and reassign those records to their own company by manipulating the company_id field in a PUT request to the supplier API endpoint.
CVE-2026-78337 is a vulnerability in Roskus Prospero Flow CRM before version 5.15.13 that allows authenticated users with create and update company permissions to upload SVG files containing embedded scripts. This can lead to arbitrary JavaScript execution within the application origin.
CVE-2026-77780 is an authorization bypass vulnerability in Roskus Prospero Flow CRM versions 4.9.1 through before 5.14.2. It allows a user with transaction and accounting creation permissions to access sensitive bank account information of other companies by supplying a bank_account_id or bank_card_id in the transaction save endpoint. The sensitive data disclosed includes bank account name, bank name, and the last four digits of the card. This occurs because the application does not verify company ownership before persisting and rendering this information.
CVE-2026-77759 is an authorization bypass vulnerability in Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5. It allows an authenticated user to access transaction data belonging to other companies on the same instance by manipulating the transaction ID in the API request. The flaw exists because the transaction API does not enforce company scoping or permission checks when resolving transaction identifiers.
Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.
CVE-2026-19870 is an authorization bypass vulnerability in the payroll module of Roskus Prospero Flow CRM versions before 5.15.10. Authenticated users with read payroll permission can view salary and banking details of employees from other companies within the same instance. Additionally, users with create payroll permission can create payroll records for employees of other companies. This occurs because the system does not properly scope queries to the caller's company and validates employee identifiers only for global existence rather than company membership.
Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and to hijack that product by reassigning its company_id, via the product's numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data['id'])` without constraining the query to the authenticated user's company before overwriting its company_id.
Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content (title, description, and attachments) of tickets belonging to another company, to hijack another company's tickets by reassigning their company_id, and to delete another company's tickets without any authorization check, via the ticket's numeric identifier, because the read and save operations retrieve the record without constraining the query to the authenticated user's company, and the delete controller type-hints a generic Illuminate\Http\Request instead of the TicketDeleteRequest that would enforce the required permission.
CVE-2026-19433 is an authorization bypass vulnerability in Roskus Prospero Flow CRM before version 5.4.8. It affects the contact management component, allowing authenticated users from any company to overwrite contact data of other companies and download personal contact data as vCards. This occurs because save and export operations do not restrict queries to the authenticated user's company.
CVE-2026-59233 is a high-severity authorization bypass vulnerability in Roskus Prospero Flow CRM versions prior to 5.2.1. The flaw exists in the permission management component, where the permission save endpoint does not perform authorization checks. This allows any authenticated user to grant any role, including their own, full application permissions by sending a crafted POST request.
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.
The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system. The controller retrieves the target record with `Notification::findOrFail($id)` and deletes it without validating `user_id` or `company_id` ownership, unlike the sibling `SetNotificationReadAjaxController`, which correctly scopes lookups by `Auth::id()`. Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events.