IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts

Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts

IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation

IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion

Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export

Stored XSS in Prospero Flow CRM email body allows administrator account takeover