CVE-2026-59236

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59236
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59236.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59236
Published
2026-07-15T11:09:38Z
Modified
2026-08-12T03:51:39Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection
Details

Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company's tenant via a spreadsheet whose company_id column points to the victim tenant, uploaded to POST /customer/import/excel/save, which maps company_id directly from the file and performs no check that it matches the authenticated user's company.

Database specific 
{
    "cna_assigner": "Secur0",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59236.json"
}
References

Affected packages

Git / github.com/roskus/prospero-flow-crm

Affected ranges

Type
GIT
Repo
https://github.com/roskus/prospero-flow-crm
Events
Introduced
ee6dff95b0f396858c3e86e8988cd0ebed363c5d
Fixed
ab96b114b3ab5c09481f39c1922cbcec151f26ed
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "5.14.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.0.0
v2.*
v2.0.1
v4.*
v4.6.0
v5.*
v5.5.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59236.json"