Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-19734 ·
High · August 13, 2026

IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

S0
Secur0 CNA
CVE-2026-19734

Description

Authorization Bypass Through User-Controlled Key (CWE-639) and Missing Authorization (CWE-862) in the product module (ProductUpdateController, ProductCreateController and ProductRepository), exposed at GET /product/update/{id} and POST /product/save, in Prospero Flow CRM 5.4.6, which allow an authenticated user of any company to read the sensitive data of a product belonging to another company (price, cost, stock, SKU and barcode) and to take that product over by reassigning its company_id, via the product's numeric identifier, because ProductUpdateController::update() retrieved the record with Product::find($id) and ProductRepository::save() with Product::find($data['id']), in both cases without constraining the query to the authenticated user's company_id before overwriting that same field with the session's value, and because neither controller extended MainController, so the auth and locked middleware applied throughout the rest of the project were not enforced on them, unlike the contact and customer modules, which do filter by company_id in their equivalent operations. This results in disclosure of the complete commercial information of other companies' products and in the unauthorized transfer of those products into the attacker's company inventory, with the corresponding loss of the record for its legitimate owner.

Vulnerability type (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-862: Missing Authorization

Affected versions

Prospero Flow CRM before 5.4.7 (fixed in 5.4.7 by commit f36c2a11, dated 2026-06-25). The read sink was introduced in commit 9e07ae4c (2022-09-07) and the save sink in commit 65f6b9f9 (2023-02-21); both were present in the v1.0.0, v2.0.1 and v4.6.0 tags, so tagged releases did ship in a vulnerable state. Version 5.4.7 carries no git tag: the earliest tag containing the fix is v5.5.3. Versions are read from the APP_VERSION constant in version.php. Default status: unaffected.

Score (CVSS 4.0)

High (8.6)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Solution

Upgrade to version 5.4.7 or higher. The fix was not tagged: the earliest tagged release containing it is v5.5.3.

Patch

Commit f36c2a11

Credits

  • Darío Rivas Quero - finder
  • Cristian Fernández Cornejo - analyst
  • Xoán M. Otero Jorge - analyst
  • Secur0 CNA - coordinator
  • Gustavo Novaro - remediation developer Discovery source: Internal Official record: CVE-2026-19734