CVE-2026-114519

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114519", "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "state": "PUBLISHED", "assignerShortName": "Secur0", "dateReserved": "2026-10-21T16:22:08.930Z", "datePublished": "2026-10-22T19:13:31.254Z", "dateUpdated": "2026-11-02T14:29:27.792Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "shortName": "Secur0", "dateUpdated": "2026-10-22T19:13:31.254Z"}, "title": "Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts", "datePublic": "2026-10-22T19:07:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "affected": [{"vendor": "Roskus", "product": "Prospero Flow CRM", "repo": "https://github.com/Roskus/prospero-flow-crm", "programFiles": ["routes/api.php", "app/Http/Controllers/Api/User/UserReadController.php", "app/Http/Controllers/Api/User/UserDeleteController.php"], "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "5.26.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "5.26.0"}]}]}], "descriptions": [{"lang": "en", "value": "Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes <code>GET /api/user/{id}</code> and <code>DELETE /api/user/{id}</code> in <code>routes/api.php</code> carry only the <code>auth:api</code> middleware, which checks that a JSON Web Token is valid and nothing more, and neither <code>UserReadController::read()</code> nor <code>UserDeleteController::delete()</code> checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is <code>Company::DEFAULT_COMPANY</code>, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer."}]}], "tags": ["x_open-source"], "references": [{"url": "https://github.com/Roskus/prospero-flow-crm/commit/52cd172ccc7c3332805d9e0b7fc992bda3d422bf", "tags": ["patch"]}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-114519-missing-authorization-user-api", "tags": ["third-party-advisory", "technical-description"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to Roskus Prospero Flow CRM 5.26.0 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to Roskus Prospero Flow CRM 5.26.0 or later."}]}], "credits": [{"lang": "en", "value": "Carlos Caminero Abad", "type": "finder"}, {"lang": "en", "value": "Dar\u00edo Rivas", "type": "analyst"}, {"lang": "en", "value": "Xo\u00e1n M. Otero Jorge", "type": "analyst"}, {"lang": "en", "value": "Secur0 CNA", "type": "coordinator"}, {"lang": "en", "value": "Gustavo Novaro", "type": "remediation developer"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T14:27:36.288060Z", "id": "CVE-2026-114519", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T14:29:27.792Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114519", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-02T14:27:36.288060Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T14:28:40.317Z"}}], "cna": {"tags": ["x_open-source"], "title": "Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Carlos Caminero Abad"}, {"lang": "en", "type": "analyst", "value": "Dar\u00edo Rivas"}, {"lang": "en", "type": "analyst", "value": "Xo\u00e1n M. Otero Jorge"}, {"lang": "en", "type": "coordinator", "value": "Secur0 CNA"}, {"lang": "en", "type": "remediation developer", "value": "Gustavo Novaro"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/Roskus/prospero-flow-crm", "vendor": "Roskus", "product": "Prospero Flow CRM", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "5.26.0", "versionType": "semver"}], "programFiles": ["routes/api.php", "app/Http/Controllers/Api/User/UserReadController.php", "app/Http/Controllers/Api/User/UserDeleteController.php"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to Roskus Prospero Flow CRM 5.26.0 or later.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to Roskus Prospero Flow CRM 5.26.0 or later.", "base64": false}]}], "datePublic": "2026-10-22T19:07:00.000Z", "references": [{"url": "https://github.com/Roskus/prospero-flow-crm/commit/52cd172ccc7c3332805d9e0b7fc992bda3d422bf", "tags": ["patch"]}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-114519-missing-authorization-user-api", "tags": ["third-party-advisory", "technical-description"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes <code>GET /api/user/{id}</code> and <code>DELETE /api/user/{id}</code> in <code>routes/api.php</code> carry only the <code>auth:api</code> middleware, which checks that a JSON Web Token is valid and nothing more, and neither <code>UserReadController::read()</code> nor <code>UserDeleteController::delete()</code> checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is <code>Company::DEFAULT_COMPANY</code>, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.26.0", "versionStartIncluding": "2.0.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "shortName": "Secur0", "dateUpdated": "2026-10-22T19:13:31.254Z"}}}, "cveMetadata": {"cveId": "CVE-2026-114519", "state": "PUBLISHED", "dateUpdated": "2026-11-02T14:29:27.792Z", "dateReserved": "2026-10-21T16:22:08.930Z", "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "datePublished": "2026-10-22T19:13:31.254Z", "assignerShortName": "Secur0"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Prospero Flow CRM", "programFiles": ["routes/api.php", "app/Http/Controllers/Api/User/UserReadController.php", "app/Http/Controllers/Api/User/UserDeleteController.php"], "repo": "https://github.com/Roskus/prospero-flow-crm", "vendor": "Roskus", "versions": [{"lessThan": "5.26.0", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer."}], "id": "CVE-2026-114519", "lastModified": "2026-11-02T15:17:13.900", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114519", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T14:27:36.288060Z", "version": "2.0.3"}}]}, "published": "2026-10-22T19:17:37.267", "references": [{"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://github.com/Roskus/prospero-flow-crm/commit/52cd172ccc7c3332805d9e0b7fc992bda3d422bf"}, {"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://secur0.com/en/cna/cve-list/cve-2026-114519-missing-authorization-user-api"}], "sourceIdentifier": "4daa8cea-433a-44bd-9456-53b127fc289a", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,5.26.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Prospero Flow CRM", "source": "cna", "vendor": "Roskus"}, "product": "prospero_flow_crm", "vendor": "roskus"}], "created": "2026-10-23T03:30:15.963785+00:00", "updated": "2026-10-23T05:00:13.490120+00:00", "vendors": ["roskus", "roskus$PRODUCT$prospero_flow_crm"]}