CVE-2026-78365CWE-639CWE-862broken-access-control

CVE-2026-78365

published August 24, 2026

CVSS
9.3
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00509 · 42.6th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-862 · Missing Authorization
Published
2026-08-24T17:19Z
References (3)
https://github.com/Roskus/prospero-flow-crm/commit/4a52477e6ed66afa436814c80e7bcd68670dd596 · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://secur0.com/en/cna/cve-list/cve-2026-78365-idor-supplier-api-cross-tenant-update · 4daa8cea-433a-44bd-9456-53b127fc289a
EPSS history
Timeline
  • 26 AUG 08:27Z
    EPSS moved — → 0%
    epss
  • 24 AUG 12:49Z
    IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
    cvelistv5