CVE-2026-78365

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Roskus/prospero-flow-crm/commit/4a52477e6ed66afa436814c80e7bcd68670dd596
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
https://secur0.com/en/cna/cve-list/cve-2026-78365-idor-supplier-api-cross-tenant-update

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Elusión de autorización a través de una clave controlada por el usuario en la API de proveedor en Roskus Prospero Flow CRM 4.0.0 hasta 5.3.1 permite a cualquier usuario autenticado leer y modificar el registro de proveedor de otra empresa, y reasignarlo a su propia empresa, a través de una solicitud PUT a /api/supplier/{id} estableciendo company_id en el cuerpo.

Information

Published : 2026-08-24 13:19

Updated : 2026-10-12 15:10

NVD link : CVE-2026-78365

Mitre link : CVE-2026-78365

CVE.ORG link : CVE-2026-78365

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-862

Missing Authorization

{"id": "CVE-2026-78365", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78365", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T12:58:38.578036Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "affectedData": [{"repo": "https://github.com/Roskus/prospero-flow-crm", "vendor": "Roskus", "modules": ["Supplier API"], "product": "Prospero Flow CRM", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "5.3.2", "versionType": "semver"}], "programFiles": ["app/Http/Controllers/Api/Supplier/SupplierUpdateController.php"], "defaultStatus": "unaffected"}]}], "published": "2026-08-24T13:19:19.247", "references": [{"url": "https://github.com/Roskus/prospero-flow-crm/commit/4a52477e6ed66afa436814c80e7bcd68670dd596", "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}, {"url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3", "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-78365-idor-supplier-api-cross-tenant-update", "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body."}, {"lang": "es", "value": "Elusi\u00f3n de autorizaci\u00f3n a trav\u00e9s de una clave controlada por el usuario en la API de proveedor en Roskus Prospero Flow CRM 4.0.0 hasta 5.3.1 permite a cualquier usuario autenticado leer y modificar el registro de proveedor de otra empresa, y reasignarlo a su propia empresa, a trav\u00e9s de una solicitud PUT a /api/supplier/{id} estableciendo company_id en el cuerpo."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "4daa8cea-433a-44bd-9456-53b127fc289a"}