CVE-2026-59237: IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders

Severity: medium (CVSS 6.9 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-16 · updated 2026-10-24
Weakness: CWE-639

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company (tenant) via a sequential numeric {id} supplied to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or DELETE /api/order-item/{id}, because the controllers resolve records with Order::find($id) / Item::find($id) without scoping by the authenticated user's company.

Affected products

Roskus Prospero Flow CRM: from 4.6.0 before 5.5.3 — fixed in 5.5.3

How to fix

Upgrade to a fixed version: Roskus Prospero Flow CRM 5.5.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-59237 or the next vulnerability affects your stack