Roskus Prospero Flow CRM Missing Authorization in User API Exposes Accounts

A missing authorization check in the user API of Roskus Prospero Flow CRM allows users with basic roles to access and delete accounts belonging to other users within their company. The vulnerability, tracked as CVE-2026-114519, affects all versions of the software before 5.26.0. It stems from the `auth:api` middleware verifying only that a JSON Web Token is valid, without checking specific permissions, policies, or roles for the requested action.

The risk

The flaw enables a user with a basic role to read the accounts of other users within their own company, including those with higher privileges. In versions from 3.5.0, the same users can delete those accounts. The routes `GET /api/user/{id}` and `DELETE /api/user/{id}` in `routes/api.php` rely solely on token validity. Neither `UserReadController::read()` nor `UserDeleteController::delete()` validates the user’s permission level before executing the operation.

Who is exposed

Object access is scoped by company, meaning the read path limits queries to the company of the authenticated user. However, the delete path skips this comparison when the authenticated user belongs to `Company::DEFAULT_COMPANY`. This allows a basic user in that default company to delete any account of any company in the installation. Deleting an account removes all data held on it, including the last administrative account of a company.

Cost and compliance

The exposure includes personal data held on the affected accounts. Attackers gain access to email addresses, telephone numbers, postal addresses, and IBANs. The ability to delete accounts without permission can lead to significant data loss and operational disruption. Organizations using Roskus Prospero Flow CRM before version 5.26.0 must assess their exposure, particularly if they operate in the default company context or have basic users with access to the user API.

What to watch

Security teams should monitor for unauthorized deletions of administrative accounts, especially those initiated by users with basic roles. Look for spikes in API calls to `GET /api/user/{id}` and `DELETE /api/user/{id}` from non-administrative tokens. Verify that no basic users have been assigned to the `Company::DEFAULT_COMPANY` context, as this bypasses standard company-scoped checks.

Signals worth monitoring

Teams usually start by reviewing API access logs for requests originating from low-privilege tokens targeting high-value endpoints like user management. Check whether unexpected deletions of administrative accounts correlate with activity from basic-role users. Look for patterns where the same token accesses multiple user IDs sequentially. Verify that role-based access controls are enforced at the application layer, not just at the authentication middleware level.

What to do and how to stay safe: Roskus

• Audit user roles and permissions to ensure basic users cannot access administrative API endpoints.
• Review API logs for unusual activity on user management routes, especially from non-administrative accounts.
• Verify that your Roskus Prospero Flow CRM version is updated to 5.26.0 or later, once the vendor provides the update.
• Implement additional monitoring for account deletion events, particularly those involving administrative accounts.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Roskus Prospero Flow CRM are affected by CVE-2026-114519?

All versions before 5.26.0 are affected. The ability to delete accounts is present in versions from 3.5.0 onward.

What data is exposed by this vulnerability?

Personal data including email addresses, telephone numbers, postal addresses, and IBANs can be accessed.

Is there a fix available for this vulnerability?

Yes, updating to version 5.26.0 or later resolves the missing authorization check.