Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export
Summary
| CVE | CVE-2026-19433 |
|---|---|
| State | PUBLISHED |
| Assigner | Secur0 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-10 15:17:43 UTC |
| Updated | 2026-08-10 18:17:43 UTC |
| Description | Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact's numeric identifier, because the save and export operations retrieve the record without constraining the query to the authenticated user's company. |
Risk And Classification
Primary CVSS: v4.0 8.6 HIGH from 4daa8cea-433a-44bd-9456-53b127fc289a
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002530000 probability, percentile 0.167480000 (date 2026-08-11)
Problem Types: CWE-639 | CWE-639 CWE-639 Authorization bypass through User-Controlled key
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 4daa8cea-433a-44bd-9456-53b127fc289a | Secondary | 8.6 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.6 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Roskus | Prospero Flow CRM | affected 5.4.8 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 | 4daa8cea-433a-44bd-9456-53b127fc289a | github.com | |
| github.com/Roskus/prospero-flow-crm/commit/f16b4af2027b17bef7c604c92dbd8... | 4daa8cea-433a-44bd-9456-53b127fc289a | github.com | |
| secur0.com/en/cna/cve-list/cve-2026-19433-idor-in-prospero-flow-crm-cont... | 4daa8cea-433a-44bd-9456-53b127fc289a | secur0.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Darío Rivas Quero (en)
CNA: Alejandro Gutiérrez López (en)
CNA: Cristian Fernández Cornejo (en)
CNA: Xoán M. Otero Jorge (en)
CNA: Secur0 CNA (en)
CNA: Gustavo Novaro (en)
Additional Advisory Data
Solutions
CNA: Upgrade to version 5.4.8 or higher.