CVE-2026-59237— roskus Prospero Flow CRM 授权问题漏洞

IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders

Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company (tenant) via a sequential numeric {id} supplied to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or DELETE /api/order-item/{id}, because the controllers resolve records with Order::find($id) / Item::find($id) without scoping by the authenticated user's company.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

通过用户控制密钥绕过授权机制

roskus Prospero Flow CRM 授权问题漏洞

roskus Prospero Flow CRM是roskus组织开源的一款基于 Laravel 13 构建的开源、多语言、多公司（白标）客户管理系统（CRM），支持 Docker 一键部署和 REST API 集成。 roskus Prospero Flow CRM 5.5.3之前版本存在授权问题漏洞，该漏洞源于Order和OrderItem REST API控制器中通过用户控制密钥绕过授权（CWE-639），允许远程、已认证用户通过提供给GET /api/order/{id}、PUT /api/ord

N/A

N/A