CVE-2026-19734

Published: Ago 13, 2026 Last Modified: Ago 13, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,6
Source: 4daa8cea-433a-44bd-9456-53b127fc289a
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and to hijack that product by reassigning its company_id, via the product's numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data['id'])` without constraining the query to the authenticated user's company before overwriting its company_id.

639

Authorization Bypass Through User-Controlled Key

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
https://github.com/Roskus/prospero-flow-crm/commit/f36c2a11…
https://github.com/Roskus/prospero-flow-crm/commit/f36c2a115f4c28c82181f1798c01…
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5…
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
https://secur0.com/en/cna/cve-list/cve-2026-19734-idor-in-p…
https://secur0.com/en/cna/cve-list/cve-2026-19734-idor-in-prospero-flow-crm-all…