Auth bypass in Roskus Prospero Flow Crm

CVE-2026-19539

Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content (title, description, and attachments) of ticket…

Vulnerability class: Broken Access Control

Affected products

Roskus Prospero Flow Crm — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

4daa8cea-433a-44bd-9456-53b127fc289a (patch)
4daa8cea-433a-44bd-9456-53b127fc289a (release-notes)
4daa8cea-433a-44bd-9456-53b127fc289a (technical-description)