Critical severity · published Aug 24, 2026
CVE-2026-78365
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
9.3
CVSS
0.5%
EPSS
No
On KEV
Description
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Prospero Flow CRM · Roskus
4.0.0 before 5.3.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78365
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78365
github.com
https://github.com/Roskus/prospero-flow-crm/commit/4a52477e6ed66afa436814c80e7bcd68670dd596
github.com
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
secur0.com
https://secur0.com/en/cna/cve-list/cve-2026-78365-idor-supplier-api-cross-tenant-update
More from Prospero Flow CRM
9.3
CVE-2026-19871
Use of hard-coded credentials in Prospero Flow CRM employee onboarding
8.7
CVE-2026-77759
IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
8.7
CVE-2026-59233
Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation
8.7
CVE-2026-59235
Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts
8.6
CVE-2026-114519
Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts