Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-19433 ·
High · August 10, 2026

Authorization Bypass Through User-Controlled Key in Prospero Flow CRM allows writing and reading other companies' contacts

S0
Secur0 CNA
CVE-2026-19433

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in ContactRepository (app/Repositories/ContactRepository.php) and in ContactExportVCard (app/Http/Controllers/Contact/ContactExportVCard.php), exposed at POST /contact/save and GET /contact/export-vcard/{id}, in Prospero Flow CRM 5.4.7, which allows an authenticated user of any company to blindly overwrite the data of a contact belonging to another company and to download that contact's personal data as a vCard, by submitting or enumerating the contact's numeric identifier, because the save() method retrieved the record to update with Contact::find($data['id']) and export() with Contact::findOrFail($id), in both cases without constraining the query to the authenticated user's company_id, unlike the sibling controllers ContactUpdateController and ContactDeleteController, which have applied that filter since commit a3a2f9f5 (PR #248). This results in unauthorized modification of the first name, last name, phone, mobile, email address, job title, LinkedIn and Twitter profiles, and notes of other companies' contacts, with no need to have read their content beforehand, and in disclosure of those same contacts' personal data through the vCard export. The same fixing commit applies the equivalent filter in SupplierContactRepository::save() and in the supplier module's ContactExportVCard::export(), two surfaces not covered by the proof of concept.

Vulnerability type (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

Affected versions

Prospero Flow CRM before 5.4.8 (fixed by commit f16b4af2, dated 2026-06-25). The fixing commit did not modify version.php, which remained at 5.4.7; the first version containing the fix is 5.4.8, set by the immediately following commit 361566c1. The write sink was introduced in commit 65f6b9f9 (2023-02-21) and the vCard export sink in commit a0306e77 (2023-02-07); both were present in the v1.0.0, v2.0.1 and v4.6.0 tags, so tagged releases did ship in a vulnerable state. Version 5.4.8 carries no git tag: the earliest tag containing the fix is v5.5.3. Versions are read from the APP_VERSION constant in version.php. Default status: unaffected.

Score (CVSS 4.0)

High (8.6)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Solution

Upgrade to version 5.4.8 or higher. The fix was not tagged: the earliest tagged release containing it is v5.5.3.

Patch

Commit f16b4af2

Credits

  • Darío Rivas Quero - finder
  • Alejandro Gutiérrez López - finder
  • Cristian Fernández Cornejo - analyst
  • Xoán M. Otero Jorge - analyst
  • Secur0 CNA - coordinator
  • Gustavo Novaro - remediation developer Discovery source: Internal Official record: CVE-2026-19433