IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion

Description

Authorization Bypass Through User-Controlled Key (CWE-639) and Missing Authorization (CWE-862) in the ticket module (TicketUpdateController, TicketRepository and TicketDeleteController), exposed at GET /ticket/update/{id}, POST /ticket/save and GET /ticket/delete/{id}, in Prospero Flow CRM 5.4.8, which allow an authenticated user of any company to read the full content of another company's ticket (title, description and attachments), to hijack it by reassigning its company_id, and to delete it, via the ticket's numeric identifier, because TicketUpdateController::update() and TicketRepository::save() retrieved the record with Ticket::find($id) without constraining the query to the authenticated user's company_id, and because TicketDeleteController::delete() type-hinted a generic Illuminate\Http\Request instead of the project's existing TicketDeleteRequest, whose authorize() method checks the delete ticket permission, so the authorization check never executed at all, unlike the contact and customer modules, which do filter by company_id in their equivalent operations. In the delete case the absence of any check was total, since the permission seeder defined no ticket permissions at all before the fix. This results in disclosure of the entire content of other companies' tickets, in those tickets being taken over by another company, and in their unauthorized deletion.

Vulnerability type (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-862: Missing Authorization

Affected versions

Prospero Flow CRM before 5.4.9 (fixed by commit b2b6ffda, dated 2026-06-25). The fixing commit did not modify version.php, which remained at 5.4.8; the first version containing the fix is 5.4.9, set by the immediately following commit 7e86b084. The delete sink was introduced in commit 946a0c5e (2022-10-30) and the read and save sinks in commit 65f6b9f9 (2023-02-21); both were present in the v1.0.0, v2.0.1 and v4.6.0 tags, so tagged releases did ship in a vulnerable state. Version 5.4.9 carries no git tag: the earliest tag containing the fix is v5.5.3. Versions are read from the APP_VERSION constant in version.php. Default status: unaffected.

Score (CVSS 4.0)

High (8.6)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Solution

Upgrade to version 5.4.9 or higher. The fix was not tagged: the earliest tagged release containing it is v5.5.3.

Patch

Commit b2b6ffda

Credits

• Darío Rivas Quero - finder
• Cristian Fernández Cornejo - analyst
• Xoán M. Otero Jorge - analyst
• Secur0 CNA - coordinator
• Gustavo Novaro - remediation developer Discovery source: Internal Official record: CVE-2026-19539