CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users to bypass authorization controls in the Roskus Prospero Flow CRM, enabling them to read and modify supplier records belonging to other companies by manipulating the company_id in a PUT request. This critical flaw poses a significant risk of data leakage and unauthorized data manipulation, potentially leading to severe operational and reputational damage. Organizations using versions 4.0.0 to 5.3.1 of this CRM should prioritize immediate remediation to safeguard sensitive supplier information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.