CyberRota Analysis
AI-GeneratedRoskus Prospero Flow CRM versions prior to 5.14.0 are vulnerable to an authorization bypass that allows authenticated users to manipulate the company_id field in Excel imports, enabling them to create customer, lead, and product records in other tenants' environments. This flaw poses a significant risk of data leakage and unauthorized access to sensitive information across different companies. Organizations using this CRM should prioritize patching to mitigate potential exploitation by malicious insiders or compromised accounts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company's tenant via a spreadsheet whose company_id column points to the victim tenant, uploaded to POST /customer/import/excel/save, which maps company_id directly from the file and performs no check that it matches the authenticated user's company.