CVE-2026-59237 | Authorization Bypass Through User-Controlled Key (CWE-639) i… | CVSS 6.9 MEDIUM

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company (tenant) via a sequential numeric {id} supplied to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or DELETE /api/order-item/{id}, because the controllers resolve records with Order::find($id) / Item::find($id) without scoping by the authenticated user's company.

Metadata

CVE ID: CVE-2026-59237
State: PUBLISHED
Assigner: Secur0
Reserved: 2026-07-03 11:24 UTC
Published: 2026-07-16 14:35 UTC
Last updated: 2026-07-16 14:55 UTC
Primary CWE: CWE-639
CWE-639 Authorization bypass through User-Controlled key
Vendor / Product: Roskus / Prospero Flow CRM
Sources: cve.org · NVD

Severity & Metrics

6.9 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Roskus	Prospero Flow CRM	—	4.6.0 < 5.5.3

Weakness (CWE)

CWE	Source	Description
CWE-639	cna	CWE-639 Authorization bypass through User-Controlled key

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.9	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References (3)