IT SBIT Services
Schneeberger
DEEN
CVE tracker

Roskus Prospero Flow CRM: Missing authorization in user API

CVE-2026-114519High 8.6

← All vulnerabilities

Summary

The user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 does not check permissions for reading and deleting user accounts. Any user with a valid token and a basic role can read accounts of other users in the same company, including administrators, together with personal data such as email address, telephone number, postal address and IBAN. From version 3.5.0, the same user can also delete accounts, and in the default company this extends to accounts of all companies on the installation.

Affected

  • Roskus Prospero Flow CRM 2.0.0 to before 5.26.0 (read endpoint from 2.0.0, delete endpoint from 3.5.0)
  • Default configuration: unaffected according to the CNA record

Fixed in

  • Upgrade to Roskus Prospero Flow CRM 5.26.0 or later (fix commit 52cd172c, as stated in the CNA record)
  • Unknown whether other release tags, such as v5.5.3, contain the fix; verify against the commit before rollout

Workaround

  • No workaround documented; no configuration setting removes the missing permission check
  • Until patched: restrict who can obtain API tokens, limit API access to trusted networks at the reverse proxy, and check which accounts belong to the default company

Exploitation

  • Not marked as known exploited in the consulted sources
  • No public proof of concept found in the research; absence of evidence is not proof, so recheck regularly

Our recommendation

  • Update to version 5.26.0 or later as a priority, especially if the CRM is reachable from the internet or used by many staff
  • Review user accounts and API tokens, and check for unexpected deletions or data access in application logs if available
  • Restrict API access to trusted networks until the update is complete
  • Assess data protection obligations (nDSG) if personal or bank data may have been exposed

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:14.

Original description (NVD)

Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed