Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-78365 ·
Critical · August 24, 2026

IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

S0
Secur0 CNA
CVE-2026-78365

Description

Authorization Bypass Through User-Controlled Key (CWE-639) and Missing Authorization (CWE-862) in SupplierUpdateController::update() (app/Http/Controllers/Api/Supplier/SupplierUpdateController.php), exposed at PUT /api/supplier/{id}, in Prospero Flow CRM before 5.3.2, which allows any authenticated user to read and modify another company's supplier by supplying its identifier, including reassigning the resource to the attacker's own company, through a request that sets company_id in the body, because the controller resolves the object with Supplier::find($id) without filtering on company_id, applies the entire body with $supplier->update($request->all()) against a model whose $fillable includes company_id, returns the resulting object in the response with account_number, order_url, order_user and order_password absent from $hidden, and is published in routes/api.php with auth:api as its only middleware while SupplierRequest::authorize() returns nothing more than Auth::check(), unlike SupplierListController::index(), SupplierReadController::read() and SupplierDeleteController::delete(), which do constrain the query by company_id on the same resource. This results in disclosure of other tenants' supplier credentials and bank details, and in the modification and relocation of those records into the attacker's tenant.

Vulnerability type (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-862: Missing Authorization

Affected versions

Prospero Flow CRM from 4.0.0 up to and including 5.3.1. The vulnerable method body was introduced in commit b03c8c6f (2024-11-01), which sets version 4.0.0; earlier versions carried the method empty and are not affected. Tags v2.0.1 (4.0.0) and v4.6.0 (4.6.0) shipped vulnerable. The fixed version 5.3.2 is not tagged: the first tagged release carrying the fix is v5.5.3. Default status: unaffected.

Score (CVSS 4.0)

Critical (9.3)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Solution

Upgrade to version 5.3.2 or later. The fix is not tagged: the first tagged release carrying it is v5.5.3. The fix constrains subsequent writes but does not revert records already modified, so review the supplier table for rows whose company_id has changed, and rotate the order portal credentials and bank details of any exposed suppliers.

Patch

Commit 4a52477e

Credits

  • Antonio Rivera Poblete - finder
  • Xoán M. Otero Jorge - analyst
  • Cristian Fernández Cornejo - analyst
  • Secur0 CNA - coordinator
  • Gustavo Novaro - remediation developer Discovery source: External Official record: CVE-2026-78365