Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts
Description
Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM, in UserReadController::read() and UserDeleteController::delete() (app/Http/Controllers/Api/User/), in Prospero Flow CRM from 2.0.0 before 5.26.0. A user with a basic role can read the accounts of other users of its own company, including accounts with higher privileges such as CompanyAdmin, and in versions from 3.5.0 can delete them.
The routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more. Neither controller checks a permission, a policy or a role before acting, so possession of any valid token for the installation is the only requirement.
Object access is scoped by company. The read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. What is absent is the permission check, not the object scoping.
The delete path skips that company comparison when the company of the authenticated user is Company::DEFAULT_COMPANY. A user with a basic role in that company can therefore delete any account of any company of the installation.
The attacker obtains the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and can delete accounts it has no permission to administer. The last administrative account of a company can be deleted.
Vulnerability type (CWE)
- CWE-862: Missing Authorization
Affected versions
Prospero Flow CRM from 2.0.0 before 5.26.0. The read endpoint is present from the earliest release that records a version, 2.0.0; the delete endpoint is added in 3.5.0. Every release from 2.0.0 to 5.25.x inclusive is affected. Default status: unaffected.
Versions are the values recorded in version.php. The repository's git tags do not correspond to them, so they cannot be used to identify an affected release: the tag v1.0.0 is dated June 2024 and carries version 3.9.8. No tag corresponds to the fixed version.
Score (CVSS 4.0)
High (8.6)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Privileges required are Low because the attacker needs a valid account on the installation, with no permission over the accounts it reads or deletes. User interaction is None because the attacker acts alone against the API. Confidentiality on the vulnerable system is High because the records returned include the personal data of the other users, the IBAN among them in every affected version. Integrity on the vulnerable system is High because the deletion destroys accounts and the data held on them, which follows the rule that create, update and delete operations are scored on integrity. Availability is None because the application continues to serve: the deletion removes records, it does not stop the service. The subsequent system metrics are None, since the absent check is authorization internal to the application and a company boundary inside it is not a separate system.
Solution
Upgrade to Prospero Flow CRM 5.26.0 or later.
No setting in the affected versions requires the read user or delete user permission on these routes, so configuration alone does not correct it.
Patch
Commit 52cd172c, released in 5.26.0. It adds ->can('read user') and ->can('delete user') to the user routes in routes/api.php, so authorization is enforced before either controller runs, and removes the Company::DEFAULT_COMPANY exception from the delete path. It pins the Spatie permission guard to web so that role permissions resolve on token authenticated requests, without which the new route checks would not evaluate, and it prevents an account that is not SuperAdmin from deleting or updating a SuperAdmin account. The same commit also gates other API routes that are outside the scope of this record.
Credits
- Carlos Caminero Abad - finder
- Darío Rivas - analyst
- Xoán M. Otero Jorge - analyst
- Secur0 CNA - coordinator
- Gustavo Novaro - remediation developer
Discovery source: External
Official record: CVE-2026-114519
Related records
- CVE-2026-78365 - missing authorization in the supplier API of the same application, fixed in 5.3.2