Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114519— Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts

Quick assessment

Affected
Roskus Prospero Flow CRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Roskus Prospero Flow CRM 2.0.0 至 5.26.0 版本的用户 API 存在授权缺失漏洞（CWE-862）。该漏洞允许拥有基础角色的用户读取其所在公司内其他用户（包括高权限用户）的账户信息；在 3.5.0 及更高版本中，还可删除这些账户。其根本原因在于 中的 和 路由仅配置了 中间件，该中间件仅验证 JSON Web Token（JWT）的有效性，未进行任何权限、策略或角色检查；同时， 和 方法在执行操作前也未验证访问权限。 对象访问范围按公司进行隔离：读取路径将查询限制在认证用户所属公

CVSS 8.6 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
Roskus Prospero Flow CRM 2.0.0< 5.26.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114519

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Roskus Prospero Flow CRM 2.0.0 ~ 5.26.0 -

II. Public POCs for CVE-2026-114519

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114519

请登录查看更多情报信息。

Other References for CVE-2026-114519 (1)

IV. Related Vulnerabilities

Same product: Prospero Flow CRM
Same vendor: Roskus
Same weakness: CWE-862

V. Comments for CVE-2026-114519

No comments yet

Leave a comment