CVE-2026-59236 | Authorization Bypass Through User-Controlled Key (CWE-639) i… | CVSS 6.9 MEDIUM

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company's tenant via a spreadsheet whose company_id column points to the victim tenant, uploaded to POST /customer/import/excel/save, which maps company_id directly from the file and performs no check that it matches the authenticated user's company.

Metadata

CVE ID: CVE-2026-59236
State: PUBLISHED
Assigner: Secur0
Reserved: 2026-07-03 11:24 UTC
Published: 2026-07-15 11:09 UTC
Last updated: 2026-07-15 12:22 UTC
Primary CWE: CWE-639
CWE-639 Authorization bypass through User-Controlled key
Vendor / Product: Roskus / Prospero Flow CRM
Sources: cve.org · NVD

Severity & Metrics

6.9 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Roskus	Prospero Flow CRM	—	1.0.0 < 5.14.0

Weakness (CWE)

CWE	Source	Description
CWE-639	cna	CWE-639 Authorization bypass through User-Controlled key

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.9	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References (3)