CVE-2026-114519— Prospero Flow CRM 用户 API 越权读取删除漏洞
一分钟漏洞结论
影响对象
Roskus Prospero Flow CRM
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Roskus Prospero Flow CRM 2.0.0 至 5.26.0 版本的用户 API 存在授权缺失漏洞（CWE-862）。该漏洞允许拥有基础角色的用户读取其所在公司内其他用户（包括高权限用户）的账户信息；在 3.5.0 及更高版本中，还可删除这些账户。其根本原因在于 中的 和 路由仅配置了 中间件，该中间件仅验证 JSON Web Token（JWT）的有效性，未进行任何权限、策略或角色检查；同时， 和 方法在执行操作前也未验证访问权限。 对象访问范围按公司进行隔离：读取路径将查询限制在认证用户所属公
影响版本矩阵 1
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Roskus | Prospero Flow CRM | 2.0.0< 5.26.0 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-114519 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts
来源: CVE Program / CVE List V5
Vulnerability Description
Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Roskus | Prospero Flow CRM | 2.0.0 ~ 5.26.0 | - |
|
二、漏洞 CVE-2026-114519 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-114519 的情报信息
请登录查看更多情报信息。
CVE-2026-114519 其他参考 (2)
-
https://secur0.com/en/cna/cve-list/cve-2026-114519-missing-authorization-user-api third-party-advisory technical-description
IV. Related Vulnerabilities
V. Comments for CVE-2026-114519
暂无评论