Vulnerabilidades de Roskus

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Roskus: 4 registro(s), com severidade, exploração e correções.

Prospero Flow CRM 4

Somente exploradas (KEV) →

CVE-2026-78365 Crítica · 9.3 CWE-639 24/08/2026

IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.

CVE-2026-78337 Média · 4.8 CWE-434 24/08/2026

Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.

CVE-2026-77780 Média · 5.3 CWE-639 21/08/2026

Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a bank_account_id or bank_card_id belonging to that company in POST /transaction/save, which is persisted and rendered without any company ownership check.

CVE-2026-77759 Alta · 8.7 CWE-639 21/08/2026

IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check.