CVE-2026-19433

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19433

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19433.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19433

Published

2026-08-10T14:04:14Z

Modified

2026-09-03T03:30:46Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export

Details

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact's numeric identifier, because the save and export operations retrieve the record without constraining the query to the authenticated user's company.

Database specific

{
    "cna_assigner": "Secur0",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19433.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "5.4.8"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "5.4.8"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "5.4.8"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/roskus/prospero-flow-crm

Affected ranges

Type

GIT

Repo

https://github.com/roskus/prospero-flow-crm

Events

Introduced

Fixed

f16b4af2027b17bef7c604c92dbd86cf38082398

Fixed

584f315878b8366244c95fe3cb016b3a63f05db8

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

v1.*

v1.0.0

v2.*

v2.0.1

v4.*

v4.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19433.json"