CVE-2026-59236 Details
Description
Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company's tenant via a spreadsheet whose company_id column points to the victim tenant, uploaded to POST /customer/import/excel/save, which maps company_id directly from the file and performs no check that it matches the authenticated user's company.
An authorization bypass vulnerability has been identified in Roskus Prospero Flow CRM versions prior to 5.14.0. This vulnerability, categorized as CWE-639, allows remote, authenticated users to inject customer, lead, and product records into another company's tenant. The issue arises in the Excel import handlers (CustomerImport, LeadImport, ProductImport), where the 'company_id' column in the uploaded spreadsheet is mapped directly to the import model without verifying if it corresponds to the authenticated user's company. As a result, an attacker can exploit this flaw by uploading a spreadsheet that targets a victim tenant, leading to unauthorized data injection that disrupts the victim company's records, metrics, and campaigns.
Users are advised to upgrade to Roskus Prospero Flow CRM version 5.14.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Roskus/prospero-flow-crm/commit/bdd6c9770a7435a45f0411154671b8a3e94dcdaa | Secur0 | Source CodeVendor |
| https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.14.0 | Secur0 | Release NotesVendor |
| https://secur0.com/en/cna/cve-list/cve-2026-59236-authorization-bypass-in-prospero-flow-crm-excel-import-allows-cross-tenant-record-injection | Secur0 | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | Secur0 |
Affected Products
| Product | Versions |
|---|---|
| Roskus Prospero Flow CRM | < 5.14.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | Secur0 |