CVE-2026-19433

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact's numeric identifier, because the save and export operations retrieve the record without constraining the query to the authenticated user's company.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Roskus/prospero-flow-crm/commit/f16b4af2027b17bef7c604c92dbd86cf38082398
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
https://secur0.com/en/cna/cve-list/cve-2026-19433-idor-in-prospero-flow-crm-contact-save-and-vcard-export

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Elusión de autorización a través de una clave controlada por el usuario en el componente de gestión de contactos en Roskus Prospero Flow CRM antes de 5.4.8 permite a usuarios autenticados de cualquier empresa sobrescribir ciegamente los datos de contacto de otra empresa y descargar los datos personales de ese contacto como una vCard a través del identificador numérico del contacto, porque las operaciones de guardar y exportar recuperan el registro sin restringir la consulta a la empresa del usuario autenticado.

Information

Published : 2026-08-10 15:17

Updated : 2026-10-23 20:10

NVD link : CVE-2026-19433

Mitre link : CVE-2026-19433

CVE.ORG link : CVE-2026-19433

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-19433", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19433", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-10T17:53:24.253600Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "affectedData": [{"repo": "https://github.com/Roskus/prospero-flow-crm", "vendor": "Roskus", "modules": ["Contact management"], "product": "Prospero Flow CRM", "versions": [{"status": "affected", "version": "0", "lessThan": "5.4.8", "versionType": "semver"}], "programFiles": ["app/Repositories/ContactRepository.php", "app/Http/Controllers/Contact/ContactExportVCard.php"], "defaultStatus": "unaffected"}]}], "published": "2026-08-10T15:17:43.330", "references": [{"url": "https://github.com/Roskus/prospero-flow-crm/commit/f16b4af2027b17bef7c604c92dbd86cf38082398", "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}, {"url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3", "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-19433-idor-in-prospero-flow-crm-contact-save-and-vcard-export", "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact's numeric identifier, because the save and export operations retrieve the record without constraining the query to the authenticated user's company."}, {"lang": "es", "value": "Elusi\u00f3n de autorizaci\u00f3n a trav\u00e9s de una clave controlada por el usuario en el componente de gesti\u00f3n de contactos en Roskus Prospero Flow CRM antes de 5.4.8 permite a usuarios autenticados de cualquier empresa sobrescribir ciegamente los datos de contacto de otra empresa y descargar los datos personales de ese contacto como una vCard a trav\u00e9s del identificador num\u00e9rico del contacto, porque las operaciones de guardar y exportar recuperan el registro sin restringir la consulta a la empresa del usuario autenticado."}], "lastModified": "2026-10-23T20:10:00.160", "sourceIdentifier": "4daa8cea-433a-44bd-9456-53b127fc289a"}