CVE-2026-114519: Prospero Flow CRM 2.0.0 to before 5.26.0

Affected technology

Prospero Flow CRM · 2.0.0 to before 5.26.0
Roskus

Description’s affected range: before 5.26.0

Component: Not specified by the source
File: routes/api.php, app/Http/Controllers/Api/User/UserReadController.php, app/Http/Controllers/Api/User/UserDeleteController.php

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A user with a basic role can read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Source advisory’s CVSS 4.0 assessment (base score 8.6/10) rates confidentiality and integrity impact as high; availability impact as none.