CVE-2026-19433: Prospero Flow CRM Auth Bypass Vulnerability

CVE-2026-19433 Overview

CVE-2026-19433 is an Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in the contact management component of Roskus Prospero Flow CRM before version 5.4.8. The flaw allows any authenticated user of one tenant company to overwrite the contact records of another company and to download a target contact's personal data as a vCard. The root cause is that the save and export operations retrieve records by numeric identifier without constraining the query to the authenticated user's company_id. The vulnerability affects both the standard Contact model and the SupplierContact model. Fixed in release v5.5.3.

Critical Impact
Authenticated users of any tenant can blindly overwrite cross-tenant contact records and exfiltrate personal data via vCard export, resulting in high confidentiality and integrity impact across all companies hosted on the same instance.

Affected Products

Roskus Prospero Flow CRM versions before 5.4.8
app/Http/Controllers/Contact/ContactExportVCard.php (Contact export endpoint)
app/Http/Controllers/Supplier/Contact/ContactExportVCard.php (Supplier contact export endpoint)

Discovery Timeline

2026-08-10 - CVE CVE-2026-19433 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-19433

Vulnerability Analysis

Prospero Flow CRM is a multi-tenant Laravel application where each record is scoped to a company_id. The contact save and vCard export controllers accept a numeric contact identifier from the request and load the record using Eloquent's findOrFail($id). This lookup ignores the tenant of the authenticated user. Any user with valid credentials can enumerate contact IDs and perform two attacks: blind writes to overwrite another tenant's contact data via the save endpoint, and information disclosure via the vCard export endpoint. The exploit requires only low-privilege authenticated access over the network and no user interaction.

Root Cause

The controllers rely on the primary key alone to resolve the target model. Because tenant isolation is enforced at the query layer rather than through a global scope on the Eloquent model, the missing where('company_id', ...) clause allows any authenticated caller to reach records outside their tenant boundary. This is a canonical Insecure Direct Object Reference [CWE-639].

Attack Vector

An authenticated attacker enumerates or guesses numeric contact IDs and issues HTTP requests to the save or vCard export endpoints. The server returns or overwrites the record without validating tenant ownership. Both Contact and SupplierContact code paths are affected.

php

// Vulnerable pattern (before patch)
$contact = Contact::findOrFail($id);

// Patched pattern (v5.5.3) — enforces tenant scoping
$contact = Contact::where('id', $id)
    ->where('company_id', Auth::user()->company_id)
    ->firstOrFail();

Source: GitHub commit f16b4af

Detection Methods for CVE-2026-19433

Indicators of Compromise

Unexpected .vcf files generated by the export routine with filenames matching the slug_YmdHis.vcf pattern for contacts outside the requesting user's company.
Web server access logs showing a single authenticated session hitting contact save or export routes with sequential or non-owned numeric IDs.
Audit-log discrepancies where a contact's updated_at changes but the modifying user belongs to a different company_id than the record.

Detection Strategies

Correlate application logs for requests to ContactExportVCard@export and the contact save endpoint against the authenticated user's company_id and the loaded record's company_id.
Alert on ID enumeration behavior: a single session accessing a wide range of distinct contact IDs in a short window.
Add database-level triggers or query logging to flag UPDATE statements on contacts and supplier_contacts where the acting user's tenant does not match the row.

Monitoring Recommendations

Ingest Laravel application logs and web access logs into a centralized analytics platform and build tenant-boundary detection rules.
Track baseline rates of vCard downloads per user and alert on volume anomalies.
Review authentication logs for accounts issuing high-frequency requests to /contact/*/vcard or contact save routes.

How to Mitigate CVE-2026-19433

Immediate Actions Required

Upgrade Roskus Prospero Flow CRM to release v5.5.3 or later, which enforces company_id scoping in both the Contact and SupplierContact export controllers.
Rotate credentials for any tenant that may have been accessed, and review recent contact modifications and vCard exports for unauthorized activity.
Audit all controllers that call findOrFail on tenant-owned models and confirm they include a company_id constraint.

Patch Information

The fix is committed in GitHub commit f16b4af and shipped in Prospero Flow CRM v5.5.3. The patch adds use Illuminate\Support\Facades\Auth; and replaces Model::findOrFail($id) with a query constrained by company_id = Auth::user()->company_id. Additional analysis is available in the SecuR0 CVE-2026-19433 advisory.

Workarounds

If immediate patching is not possible, place a reverse-proxy or middleware rule that inspects contact IDs against the session's tenant claim before the request reaches the application.
Apply a Laravel global scope on the Contact and SupplierContact models to inject a company_id filter on every query as a defense-in-depth measure.
Restrict access to the affected endpoints to a narrow allowlist of trusted administrators until the upgrade is deployed.

bash

# Verify installed version and upgrade to the fixed release
cd /path/to/prospero-flow-crm
git fetch --tags
git checkout v5.5.3
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache