CyberRota Analysis
AI-GeneratedThe contact management component in Roskus Prospero Flow CRM versions prior to 5.4.8 is vulnerable to an authorization bypass, allowing authenticated users to overwrite contact data and download personal information from other companies. This flaw arises from insufficient query constraints, enabling unauthorized access to sensitive data. Organizations using this CRM should prioritize patching to mitigate the risk of data breaches and unauthorized data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact's numeric identifier, because the save and export operations retrieve the record without constraining the query to the authenticated user's company.