CVE-2026-19734

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19734

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19734.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19734

Published

2026-08-13T14:04:55Z

Modified

2026-09-03T03:30:32Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

Details

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and to hijack that product by reassigning its company_id, via the product's numeric identifier, because ProductUpdateController did not extend MainController and therefore required no authentication check on the read endpoint, and ProductRepository::save() retrieved the record via Product::find($data['id']) without constraining the query to the authenticated user's company before overwriting its company_id.

Database specific

{
    "cna_assigner": "Secur0",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19734.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "5.4.7"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "5.4.7"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "5.4.7"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/roskus/prospero-flow-crm

Affected ranges

Type

GIT

Repo

https://github.com/roskus/prospero-flow-crm

Events

Introduced

Fixed

f36c2a115f4c28c82181f1798c01582ae953b932

Fixed

584f315878b8366244c95fe3cb016b3a63f05db8

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

v1.*

v1.0.0

v2.*

v2.0.1

v4.*

v4.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19734.json"